feat: add DCB User Service API - Authentication system with KEYCLOAK - Modular architecture with services for each feature
This commit is contained in:
diallolatoile
commit
e5f44ffdc0
56
.gitignore
vendored
Normal file
56
.gitignore
vendored
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
# compiled output
|
||||||
|
/dist
|
||||||
|
/node_modules
|
||||||
|
/build
|
||||||
|
|
||||||
|
# Logs
|
||||||
|
logs
|
||||||
|
*.log
|
||||||
|
npm-debug.log*
|
||||||
|
pnpm-debug.log*
|
||||||
|
yarn-debug.log*
|
||||||
|
yarn-error.log*
|
||||||
|
lerna-debug.log*
|
||||||
|
|
||||||
|
# OS
|
||||||
|
.DS_Store
|
||||||
|
|
||||||
|
# Tests
|
||||||
|
/coverage
|
||||||
|
/.nyc_output
|
||||||
|
|
||||||
|
# IDEs and editors
|
||||||
|
/.idea
|
||||||
|
.project
|
||||||
|
.classpath
|
||||||
|
.c9/
|
||||||
|
*.launch
|
||||||
|
.settings/
|
||||||
|
*.sublime-workspace
|
||||||
|
|
||||||
|
# IDE - VSCode
|
||||||
|
.vscode/*
|
||||||
|
!.vscode/settings.json
|
||||||
|
!.vscode/tasks.json
|
||||||
|
!.vscode/launch.json
|
||||||
|
!.vscode/extensions.json
|
||||||
|
|
||||||
|
# dotenv environment variable files
|
||||||
|
.env
|
||||||
|
.env.development.local
|
||||||
|
.env.test.local
|
||||||
|
.env.production.local
|
||||||
|
.env.local
|
||||||
|
|
||||||
|
# temp directory
|
||||||
|
.temp
|
||||||
|
.tmp
|
||||||
|
|
||||||
|
# Runtime data
|
||||||
|
pids
|
||||||
|
*.pid
|
||||||
|
*.seed
|
||||||
|
*.pid.lock
|
||||||
|
|
||||||
|
# Diagnostic reports (https://nodejs.org/api/report.html)
|
||||||
|
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
|
||||||
4
.prettierrc
Normal file
4
.prettierrc
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
{
|
||||||
|
"singleQuote": true,
|
||||||
|
"trailingComma": "all"
|
||||||
|
}
|
||||||
98
README.md
Normal file
98
README.md
Normal file
@ -0,0 +1,98 @@
|
|||||||
|
<p align="center">
|
||||||
|
<a href="http://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
[circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
|
||||||
|
[circleci-url]: https://circleci.com/gh/nestjs/nest
|
||||||
|
|
||||||
|
<p align="center">A progressive <a href="http://nodejs.org" target="_blank">Node.js</a> framework for building efficient and scalable server-side applications.</p>
|
||||||
|
<p align="center">
|
||||||
|
<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/v/@nestjs/core.svg" alt="NPM Version" /></a>
|
||||||
|
<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/l/@nestjs/core.svg" alt="Package License" /></a>
|
||||||
|
<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/dm/@nestjs/common.svg" alt="NPM Downloads" /></a>
|
||||||
|
<a href="https://circleci.com/gh/nestjs/nest" target="_blank"><img src="https://img.shields.io/circleci/build/github/nestjs/nest/master" alt="CircleCI" /></a>
|
||||||
|
<a href="https://discord.gg/G7Qnnhy" target="_blank"><img src="https://img.shields.io/badge/discord-online-brightgreen.svg" alt="Discord"/></a>
|
||||||
|
<a href="https://opencollective.com/nest#backer" target="_blank"><img src="https://opencollective.com/nest/backers/badge.svg" alt="Backers on Open Collective" /></a>
|
||||||
|
<a href="https://opencollective.com/nest#sponsor" target="_blank"><img src="https://opencollective.com/nest/sponsors/badge.svg" alt="Sponsors on Open Collective" /></a>
|
||||||
|
<a href="https://paypal.me/kamilmysliwiec" target="_blank"><img src="https://img.shields.io/badge/Donate-PayPal-ff3f59.svg" alt="Donate us"/></a>
|
||||||
|
<a href="https://opencollective.com/nest#sponsor" target="_blank"><img src="https://img.shields.io/badge/Support%20us-Open%20Collective-41B883.svg" alt="Support us"></a>
|
||||||
|
<a href="https://twitter.com/nestframework" target="_blank"><img src="https://img.shields.io/twitter/follow/nestframework.svg?style=social&label=Follow" alt="Follow us on Twitter"></a>
|
||||||
|
</p>
|
||||||
|
<!--[](https://opencollective.com/nest#backer)
|
||||||
|
[](https://opencollective.com/nest#sponsor)-->
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
[Nest](https://github.com/nestjs/nest) framework TypeScript starter repository.
|
||||||
|
|
||||||
|
## Project setup
|
||||||
|
|
||||||
|
```bash
|
||||||
|
$ npm install
|
||||||
|
```
|
||||||
|
|
||||||
|
## Compile and run the project
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# development
|
||||||
|
$ npm run start
|
||||||
|
|
||||||
|
# watch mode
|
||||||
|
$ npm run start:dev
|
||||||
|
|
||||||
|
# production mode
|
||||||
|
$ npm run start:prod
|
||||||
|
```
|
||||||
|
|
||||||
|
## Run tests
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# unit tests
|
||||||
|
$ npm run test
|
||||||
|
|
||||||
|
# e2e tests
|
||||||
|
$ npm run test:e2e
|
||||||
|
|
||||||
|
# test coverage
|
||||||
|
$ npm run test:cov
|
||||||
|
```
|
||||||
|
|
||||||
|
## Deployment
|
||||||
|
|
||||||
|
When you're ready to deploy your NestJS application to production, there are some key steps you can take to ensure it runs as efficiently as possible. Check out the [deployment documentation](https://docs.nestjs.com/deployment) for more information.
|
||||||
|
|
||||||
|
If you are looking for a cloud-based platform to deploy your NestJS application, check out [Mau](https://mau.nestjs.com), our official platform for deploying NestJS applications on AWS. Mau makes deployment straightforward and fast, requiring just a few simple steps:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
$ npm install -g @nestjs/mau
|
||||||
|
$ mau deploy
|
||||||
|
```
|
||||||
|
|
||||||
|
With Mau, you can deploy your application in just a few clicks, allowing you to focus on building features rather than managing infrastructure.
|
||||||
|
|
||||||
|
## Resources
|
||||||
|
|
||||||
|
Check out a few resources that may come in handy when working with NestJS:
|
||||||
|
|
||||||
|
- Visit the [NestJS Documentation](https://docs.nestjs.com) to learn more about the framework.
|
||||||
|
- For questions and support, please visit our [Discord channel](https://discord.gg/G7Qnnhy).
|
||||||
|
- To dive deeper and get more hands-on experience, check out our official video [courses](https://courses.nestjs.com/).
|
||||||
|
- Deploy your application to AWS with the help of [NestJS Mau](https://mau.nestjs.com) in just a few clicks.
|
||||||
|
- Visualize your application graph and interact with the NestJS application in real-time using [NestJS Devtools](https://devtools.nestjs.com).
|
||||||
|
- Need help with your project (part-time to full-time)? Check out our official [enterprise support](https://enterprise.nestjs.com).
|
||||||
|
- To stay in the loop and get updates, follow us on [X](https://x.com/nestframework) and [LinkedIn](https://linkedin.com/company/nestjs).
|
||||||
|
- Looking for a job, or have a job to offer? Check out our official [Jobs board](https://jobs.nestjs.com).
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please [read more here](https://docs.nestjs.com/support).
|
||||||
|
|
||||||
|
## Stay in touch
|
||||||
|
|
||||||
|
- Author - [Kamil Myśliwiec](https://twitter.com/kammysliwiec)
|
||||||
|
- Website - [https://nestjs.com](https://nestjs.com/)
|
||||||
|
- Twitter - [@nestframework](https://twitter.com/nestframework)
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Nest is [MIT licensed](https://github.com/nestjs/nest/blob/master/LICENSE).
|
||||||
35
eslint.config.mjs
Normal file
35
eslint.config.mjs
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
// @ts-check
|
||||||
|
import eslint from '@eslint/js';
|
||||||
|
import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
|
||||||
|
import globals from 'globals';
|
||||||
|
import tseslint from 'typescript-eslint';
|
||||||
|
|
||||||
|
export default tseslint.config(
|
||||||
|
{
|
||||||
|
ignores: ['eslint.config.mjs'],
|
||||||
|
},
|
||||||
|
eslint.configs.recommended,
|
||||||
|
...tseslint.configs.recommendedTypeChecked,
|
||||||
|
eslintPluginPrettierRecommended,
|
||||||
|
{
|
||||||
|
languageOptions: {
|
||||||
|
globals: {
|
||||||
|
...globals.node,
|
||||||
|
...globals.jest,
|
||||||
|
},
|
||||||
|
sourceType: 'commonjs',
|
||||||
|
parserOptions: {
|
||||||
|
projectService: true,
|
||||||
|
tsconfigRootDir: import.meta.dirname,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
rules: {
|
||||||
|
'@typescript-eslint/no-explicit-any': 'off',
|
||||||
|
'@typescript-eslint/no-floating-promises': 'warn',
|
||||||
|
'@typescript-eslint/no-unsafe-argument': 'warn',
|
||||||
|
"prettier/prettier": ["error", { endOfLine: "auto" }],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
);
|
||||||
8
nest-cli.json
Normal file
8
nest-cli.json
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://json.schemastore.org/nest-cli",
|
||||||
|
"collection": "@nestjs/schematics",
|
||||||
|
"sourceRoot": "src",
|
||||||
|
"compilerOptions": {
|
||||||
|
"deleteOutDir": true
|
||||||
|
}
|
||||||
|
}
|
||||||
11490
package-lock.json
generated
Normal file
11490
package-lock.json
generated
Normal file
File diff suppressed because it is too large
Load Diff
87
package.json
Normal file
87
package.json
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
{
|
||||||
|
"name": "dcb-user-service",
|
||||||
|
"version": "0.0.1",
|
||||||
|
"description": "",
|
||||||
|
"author": "",
|
||||||
|
"private": true,
|
||||||
|
"license": "UNLICENSED",
|
||||||
|
"scripts": {
|
||||||
|
"build": "nest build",
|
||||||
|
"format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
|
||||||
|
"start": "nest start",
|
||||||
|
"start:dev": "nest start --watch",
|
||||||
|
"start:debug": "nest start --debug --watch",
|
||||||
|
"start:prod": "node dist/main",
|
||||||
|
"lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
|
||||||
|
"test": "jest",
|
||||||
|
"test:watch": "jest --watch",
|
||||||
|
"test:cov": "jest --coverage",
|
||||||
|
"test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
|
||||||
|
"test:e2e": "jest --config ./test/jest-e2e.json"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"@nestjs/axios": "^4.0.1",
|
||||||
|
"@nestjs/common": "^11.1.7",
|
||||||
|
"@nestjs/config": "^4.0.2",
|
||||||
|
"@nestjs/core": "^11.1.7",
|
||||||
|
"@nestjs/jwt": "^11.0.1",
|
||||||
|
"@nestjs/platform-express": "^11.1.7",
|
||||||
|
"@nestjs/terminus": "^11.0.0",
|
||||||
|
"@nestjs/throttler": "^6.4.0",
|
||||||
|
"axios": "^1.12.2",
|
||||||
|
"class-transformer": "^0.5.1",
|
||||||
|
"class-validator": "^0.14.2",
|
||||||
|
"helmet": "^8.1.0",
|
||||||
|
"jwt-decode": "^4.0.0",
|
||||||
|
"keycloak-connect": "^26.1.1",
|
||||||
|
"nest-keycloak-connect": "^1.10.1",
|
||||||
|
"passport": "^0.7.0",
|
||||||
|
"passport-http-bearer": "^1.0.1",
|
||||||
|
"reflect-metadata": "^0.2.2",
|
||||||
|
"rxjs": "^7.8.2"
|
||||||
|
},
|
||||||
|
"devDependencies": {
|
||||||
|
"@eslint/eslintrc": "^3.3.1",
|
||||||
|
"@eslint/js": "^9.38.0",
|
||||||
|
"@nestjs/cli": "^11.0.10",
|
||||||
|
"@nestjs/schematics": "^11.0.9",
|
||||||
|
"@nestjs/testing": "^11.1.7",
|
||||||
|
"@types/express": "^5.0.3",
|
||||||
|
"@types/jest": "^30.0.0",
|
||||||
|
"@types/joi": "^17.2.3",
|
||||||
|
"@types/node": "^24.9.1",
|
||||||
|
"@types/passport-http-bearer": "^1.0.42",
|
||||||
|
"@types/supertest": "^6.0.3",
|
||||||
|
"eslint": "^9.38.0",
|
||||||
|
"eslint-config-prettier": "^10.1.8",
|
||||||
|
"eslint-plugin-prettier": "^5.5.4",
|
||||||
|
"globals": "^16.4.0",
|
||||||
|
"jest": "^30.2.0",
|
||||||
|
"prettier": "^3.6.2",
|
||||||
|
"source-map-support": "^0.5.21",
|
||||||
|
"supertest": "^7.1.4",
|
||||||
|
"ts-jest": "^29.4.5",
|
||||||
|
"ts-loader": "^9.5.4",
|
||||||
|
"ts-node": "^10.9.2",
|
||||||
|
"tsconfig-paths": "^4.2.0",
|
||||||
|
"typescript": "^5.9.3",
|
||||||
|
"typescript-eslint": "^8.46.2"
|
||||||
|
},
|
||||||
|
"jest": {
|
||||||
|
"moduleFileExtensions": [
|
||||||
|
"js",
|
||||||
|
"json",
|
||||||
|
"ts"
|
||||||
|
],
|
||||||
|
"rootDir": "src",
|
||||||
|
"testRegex": ".*\\.spec\\.ts$",
|
||||||
|
"transform": {
|
||||||
|
"^.+\\.(t|j)s$": "ts-jest"
|
||||||
|
},
|
||||||
|
"collectCoverageFrom": [
|
||||||
|
"**/*.(t|j)s"
|
||||||
|
],
|
||||||
|
"coverageDirectory": "../coverage",
|
||||||
|
"testEnvironment": "node"
|
||||||
|
}
|
||||||
|
}
|
||||||
10
src/api/api.module.ts
Normal file
10
src/api/api.module.ts
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
import { Module } from '@nestjs/common';
|
||||||
|
import { AuthModule } from '../auth/auth.module';
|
||||||
|
|
||||||
|
import { ApiController } from './controllers/api.controller';
|
||||||
|
|
||||||
|
@Module({
|
||||||
|
imports: [AuthModule],
|
||||||
|
controllers: [ApiController],
|
||||||
|
})
|
||||||
|
export class ApiModule {}
|
||||||
33
src/api/controllers/api.controller.ts
Normal file
33
src/api/controllers/api.controller.ts
Normal file
@ -0,0 +1,33 @@
|
|||||||
|
import { Controller, Get, Req, UseGuards, Logger } from '@nestjs/common';
|
||||||
|
import { ClientCredentialsGuard } from '../../auth/guards/client-credentials.guard';
|
||||||
|
import { Roles } from '../../decorators/roles.decorator';
|
||||||
|
|
||||||
|
@Controller('api')
|
||||||
|
@UseGuards(ClientCredentialsGuard) // applique le guard à tout le controller
|
||||||
|
export class ApiController {
|
||||||
|
private readonly logger = new Logger(ApiController.name);
|
||||||
|
|
||||||
|
@Get('protected')
|
||||||
|
@Roles('DCB_ADMIN') // ex: uniquement les clients avec DCB_ADMIN peuvent accéder
|
||||||
|
getProtected() {
|
||||||
|
this.logger.log('Accessed protected route');
|
||||||
|
return {
|
||||||
|
message: 'Protected route accessed successfully',
|
||||||
|
time: new Date().toISOString(),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
@Get('protected-data')
|
||||||
|
@Roles('DCB_MANAGER', 'DCB_ADMIN') // plusieurs rôles possibles
|
||||||
|
getProtectedData(@Req() request: Request) {
|
||||||
|
const token = request['accessToken']; // injecté par le ClientCredentialsGuard
|
||||||
|
|
||||||
|
this.logger.log('Accessing protected data with client credentials');
|
||||||
|
|
||||||
|
return {
|
||||||
|
message: 'This is protected data accessed using client credentials',
|
||||||
|
timestamp: new Date().toISOString(),
|
||||||
|
tokenPreview: token ? `${token.substring(0, 20)}...` : 'No token',
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
22
src/app.controller.spec.ts.org
Normal file
22
src/app.controller.spec.ts.org
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
import { Test, TestingModule } from '@nestjs/testing';
|
||||||
|
import { AppController } from './app.controller';
|
||||||
|
import { AppService } from './app.service';
|
||||||
|
|
||||||
|
describe('AppController', () => {
|
||||||
|
let appController: AppController;
|
||||||
|
|
||||||
|
beforeEach(async () => {
|
||||||
|
const app: TestingModule = await Test.createTestingModule({
|
||||||
|
controllers: [AppController],
|
||||||
|
providers: [AppService],
|
||||||
|
}).compile();
|
||||||
|
|
||||||
|
appController = app.get<AppController>(AppController);
|
||||||
|
});
|
||||||
|
|
||||||
|
describe('root', () => {
|
||||||
|
it('should return "Hello World!"', () => {
|
||||||
|
expect(appController.getHello()).toBe('Hello World!');
|
||||||
|
});
|
||||||
|
});
|
||||||
|
});
|
||||||
12
src/app.controller.ts.org
Normal file
12
src/app.controller.ts.org
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
import { Controller, Get } from '@nestjs/common';
|
||||||
|
import { AppService } from './app.service';
|
||||||
|
|
||||||
|
@Controller()
|
||||||
|
export class AppController {
|
||||||
|
constructor(private readonly appService: AppService) {}
|
||||||
|
|
||||||
|
@Get()
|
||||||
|
getHello(): string {
|
||||||
|
return this.appService.getHello();
|
||||||
|
}
|
||||||
|
}
|
||||||
95
src/app.module.ts
Normal file
95
src/app.module.ts
Normal file
@ -0,0 +1,95 @@
|
|||||||
|
import { Module } from '@nestjs/common';
|
||||||
|
import { ConfigModule, ConfigService } from '@nestjs/config';
|
||||||
|
import { APP_GUARD } from '@nestjs/core';
|
||||||
|
import {
|
||||||
|
AuthGuard,
|
||||||
|
KeycloakConnectConfig,
|
||||||
|
KeycloakConnectModule,
|
||||||
|
ResourceGuard,
|
||||||
|
RoleGuard,
|
||||||
|
TokenValidation,
|
||||||
|
} from 'nest-keycloak-connect';
|
||||||
|
import { HttpModule } from '@nestjs/axios';
|
||||||
|
import { TerminusModule } from '@nestjs/terminus';
|
||||||
|
|
||||||
|
import keycloakConfig, { keycloakConfigValidationSchema } from './config/keycloak.config';
|
||||||
|
import { AuthModule } from './auth/auth.module';
|
||||||
|
import { ApiModule } from './api/api.module';
|
||||||
|
import { HealthModule } from './health/health.module';
|
||||||
|
import { UsersModule } from './users/users.module';
|
||||||
|
|
||||||
|
@Module({
|
||||||
|
imports: [
|
||||||
|
// Configuration Module
|
||||||
|
ConfigModule.forRoot({
|
||||||
|
isGlobal: true,
|
||||||
|
load: [keycloakConfig],
|
||||||
|
validationSchema: keycloakConfigValidationSchema,
|
||||||
|
validationOptions: {
|
||||||
|
allowUnknown: false,
|
||||||
|
abortEarly: true,
|
||||||
|
},
|
||||||
|
}),
|
||||||
|
|
||||||
|
// Keycloak Connect Module (Async configuration)
|
||||||
|
KeycloakConnectModule.registerAsync({
|
||||||
|
imports: [ConfigModule],
|
||||||
|
inject: [ConfigService],
|
||||||
|
useFactory: (configService: ConfigService): KeycloakConnectConfig => {
|
||||||
|
const keycloakConfig = configService.get('keycloak');
|
||||||
|
|
||||||
|
return {
|
||||||
|
authServerUrl: keycloakConfig.serverUrl,
|
||||||
|
realm: keycloakConfig.realm,
|
||||||
|
clientId: keycloakConfig.clientId,
|
||||||
|
secret: keycloakConfig.clientSecret,
|
||||||
|
useNestLogger: true,
|
||||||
|
bearerOnly: true,
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Validation OFFLINE :
|
||||||
|
* Le token JWT est validé localement (RS256 signature)
|
||||||
|
* Aucun appel réseau vers Keycloak pour introspection.
|
||||||
|
*/
|
||||||
|
tokenValidation: TokenValidation.OFFLINE,
|
||||||
|
|
||||||
|
// Optional: Add more Keycloak options as needed
|
||||||
|
// publicClient: false,
|
||||||
|
// verifyTokenAudience: true,
|
||||||
|
// confidentialPort: 0,
|
||||||
|
};
|
||||||
|
},
|
||||||
|
}),
|
||||||
|
|
||||||
|
// HTTP and Health Modules
|
||||||
|
HttpModule.register({
|
||||||
|
timeout: 5000,
|
||||||
|
maxRedirects: 5,
|
||||||
|
}),
|
||||||
|
TerminusModule,
|
||||||
|
|
||||||
|
// Feature Modules
|
||||||
|
AuthModule,
|
||||||
|
ApiModule,
|
||||||
|
HealthModule,
|
||||||
|
UsersModule,
|
||||||
|
],
|
||||||
|
providers: [
|
||||||
|
// Global Authentication Guard
|
||||||
|
{
|
||||||
|
provide: APP_GUARD,
|
||||||
|
useClass: AuthGuard,
|
||||||
|
},
|
||||||
|
// Global Resource Guard
|
||||||
|
{
|
||||||
|
provide: APP_GUARD,
|
||||||
|
useClass: ResourceGuard,
|
||||||
|
},
|
||||||
|
// Global Role Guard
|
||||||
|
{
|
||||||
|
provide: APP_GUARD,
|
||||||
|
useClass: RoleGuard,
|
||||||
|
},
|
||||||
|
],
|
||||||
|
})
|
||||||
|
export class AppModule {}
|
||||||
8
src/app.service.ts.org
Normal file
8
src/app.service.ts.org
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
import { Injectable } from '@nestjs/common';
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class AppService {
|
||||||
|
getHello(): string {
|
||||||
|
return 'Hello World!';
|
||||||
|
}
|
||||||
|
}
|
||||||
21
src/auth/auth.module.ts
Normal file
21
src/auth/auth.module.ts
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
import { Module } from '@nestjs/common';
|
||||||
|
import { HttpModule } from '@nestjs/axios';
|
||||||
|
import { JwtModule } from '@nestjs/jwt';
|
||||||
|
import { StartupService } from './services/startup.service';
|
||||||
|
import { TokenService } from './services/token.service';
|
||||||
|
import { KeycloakApiService } from './services/keycloak-api.service';
|
||||||
|
import { AuthController } from './controllers/auth.controller';
|
||||||
|
import { HealthController } from '../health/health.controller';
|
||||||
|
import { UsersService } from '../users/services/users.service';
|
||||||
|
|
||||||
|
|
||||||
|
@Module({
|
||||||
|
imports: [
|
||||||
|
HttpModule,
|
||||||
|
JwtModule.register({}),
|
||||||
|
],
|
||||||
|
providers: [StartupService, TokenService, KeycloakApiService, UsersService],
|
||||||
|
controllers: [AuthController, HealthController],
|
||||||
|
exports: [StartupService, TokenService, KeycloakApiService, UsersService, JwtModule],
|
||||||
|
})
|
||||||
|
export class AuthModule {}
|
||||||
203
src/auth/controllers/auth.controller.ts
Normal file
203
src/auth/controllers/auth.controller.ts
Normal file
@ -0,0 +1,203 @@
|
|||||||
|
import {
|
||||||
|
Controller,
|
||||||
|
Req,
|
||||||
|
Get,
|
||||||
|
Post,
|
||||||
|
Body,
|
||||||
|
Param,
|
||||||
|
Logger,
|
||||||
|
HttpException,
|
||||||
|
HttpStatus,
|
||||||
|
} from '@nestjs/common';
|
||||||
|
import {
|
||||||
|
AuthenticatedUser,
|
||||||
|
Public,
|
||||||
|
Roles,
|
||||||
|
} from 'nest-keycloak-connect';
|
||||||
|
import { TokenService } from '../services/token.service';
|
||||||
|
import { KeycloakApiService } from '../services/keycloak-api.service';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
import type { Request } from 'express';
|
||||||
|
import { UsersService } from '../../users/services/users.service';
|
||||||
|
|
||||||
|
interface LoginDto {
|
||||||
|
username: string;
|
||||||
|
password: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Controller('auth')
|
||||||
|
export class AuthController {
|
||||||
|
private readonly logger = new Logger(AuthController.name);
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly tokenService: TokenService,
|
||||||
|
private readonly keycloakApiService: KeycloakApiService,
|
||||||
|
private readonly configService: ConfigService,
|
||||||
|
private readonly usersService: UsersService
|
||||||
|
) {}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* LOGIN (Resource Owner Password Credentials)
|
||||||
|
* ------------------------------- */
|
||||||
|
@Public()
|
||||||
|
@Post('login')
|
||||||
|
async login(
|
||||||
|
@Body() loginDto: LoginDto
|
||||||
|
): Promise<{
|
||||||
|
access_token: string;
|
||||||
|
refresh_token?: string;
|
||||||
|
expires_in: number;
|
||||||
|
token_type: string;
|
||||||
|
}> {
|
||||||
|
const { username, password } = loginDto;
|
||||||
|
|
||||||
|
if (!username || !password) {
|
||||||
|
throw new HttpException('Username and password are required', HttpStatus.BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const tokenResponse = await this.tokenService.acquireUserToken(username, password);
|
||||||
|
this.logger.log(`User "${username}" authenticated successfully`);
|
||||||
|
|
||||||
|
return {
|
||||||
|
access_token: tokenResponse.access_token,
|
||||||
|
refresh_token: tokenResponse.refresh_token,
|
||||||
|
expires_in: tokenResponse.expires_in,
|
||||||
|
token_type: 'Bearer',
|
||||||
|
};
|
||||||
|
} catch (err: any) {
|
||||||
|
const errorMessage = err.message;
|
||||||
|
|
||||||
|
// Gestion spécifique des erreurs Keycloak
|
||||||
|
if (errorMessage.includes('Account is not fully set up')) {
|
||||||
|
this.logger.warn(`User account not fully set up: "${username}"`);
|
||||||
|
throw new HttpException(
|
||||||
|
'Account setup incomplete. Please contact administrator.',
|
||||||
|
HttpStatus.FORBIDDEN
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (errorMessage.includes('Invalid user credentials')) {
|
||||||
|
this.logger.warn(`Invalid credentials for user: "${username}"`);
|
||||||
|
throw new HttpException(
|
||||||
|
'Invalid username or password',
|
||||||
|
HttpStatus.UNAUTHORIZED
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (errorMessage.includes('User is disabled')) {
|
||||||
|
this.logger.warn(`Disabled user attempted login: "${username}"`);
|
||||||
|
throw new HttpException(
|
||||||
|
'Account is disabled',
|
||||||
|
HttpStatus.FORBIDDEN
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.warn(`Authentication failed for "${username}": ${errorMessage}`);
|
||||||
|
throw new HttpException(
|
||||||
|
'Authentication failed',
|
||||||
|
HttpStatus.UNAUTHORIZED
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* LOGOUT
|
||||||
|
* ------------------------------- */
|
||||||
|
@Post('logout')
|
||||||
|
async logout(@Req() req: Request) {
|
||||||
|
const token = req.headers['authorization']?.split(' ')[1];
|
||||||
|
|
||||||
|
if (!token) {
|
||||||
|
throw new HttpException('No token provided', HttpStatus.BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const refreshToken = await this.tokenService.getStoredRefreshToken(token);
|
||||||
|
if (refreshToken) {
|
||||||
|
await this.tokenService.revokeToken(refreshToken);
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.log(`User logged out successfully`);
|
||||||
|
return { message: 'Logout successful' };
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Logout failed', error);
|
||||||
|
throw new HttpException('Logout failed', HttpStatus.INTERNAL_SERVER_ERROR);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* GET CURRENT USER (from token)
|
||||||
|
* ------------------------------- */
|
||||||
|
@Get('me')
|
||||||
|
async getCurrentUser(@Req() req: Request, @AuthenticatedUser() user: any) {
|
||||||
|
const authHeader = req.headers['authorization'];
|
||||||
|
const token = authHeader?.replace('Bearer ', '').trim();
|
||||||
|
|
||||||
|
if (!token) throw new HttpException('Missing token', HttpStatus.BAD_REQUEST);
|
||||||
|
return this.usersService.getUserProfile(token);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* GET USER BY ID
|
||||||
|
* ------------------------------- */
|
||||||
|
@Get('profile/:id')
|
||||||
|
@Roles({ roles: ['admin', 'viewer'] })
|
||||||
|
async getUserById(@Param('id') id: string) {
|
||||||
|
return this.usersService.getUserById(id);
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* REFRESH TOKEN
|
||||||
|
* ------------------------------- */
|
||||||
|
@Public()
|
||||||
|
@Post('refresh')
|
||||||
|
async refreshToken(@Body() body: { refresh_token: string }) {
|
||||||
|
const { refresh_token } = body;
|
||||||
|
|
||||||
|
if (!refresh_token) {
|
||||||
|
throw new HttpException('Refresh token is required', HttpStatus.BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const tokenResponse = await this.tokenService.refreshToken(refresh_token);
|
||||||
|
|
||||||
|
return {
|
||||||
|
access_token: tokenResponse.access_token,
|
||||||
|
refresh_token: tokenResponse.refresh_token,
|
||||||
|
expires_in: tokenResponse.expires_in,
|
||||||
|
token_type: 'Bearer',
|
||||||
|
};
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Token refresh failed', error);
|
||||||
|
throw new HttpException('Invalid refresh token', HttpStatus.UNAUTHORIZED);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* AUTH STATUS CHECK (public)
|
||||||
|
* ------------------------------- */
|
||||||
|
@Public()
|
||||||
|
@Get('status')
|
||||||
|
async getAuthStatus(@Req() req: Request) {
|
||||||
|
const authHeader = req.headers['authorization'];
|
||||||
|
let isValid = false;
|
||||||
|
|
||||||
|
if (authHeader) {
|
||||||
|
try {
|
||||||
|
const token = authHeader.replace('Bearer ', '');
|
||||||
|
isValid = await this.tokenService.validateToken(token);
|
||||||
|
} catch (error) {
|
||||||
|
this.logger.debug('Token validation failed in status check');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return {
|
||||||
|
authenticated: isValid,
|
||||||
|
status: isValid ? 'Token is valid' : 'Token is invalid or expired',
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
56
src/auth/guards/client-credentials.guard.ts
Normal file
56
src/auth/guards/client-credentials.guard.ts
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
import { Injectable, CanActivate, ExecutionContext, Logger, UnauthorizedException, ForbiddenException } from '@nestjs/common';
|
||||||
|
import { TokenService } from '../services/token.service';
|
||||||
|
import { JwtService } from '@nestjs/jwt';
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class ClientCredentialsGuard implements CanActivate {
|
||||||
|
private readonly logger = new Logger(ClientCredentialsGuard.name);
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly tokenService: TokenService,
|
||||||
|
private readonly jwtService: JwtService, // Injection du JwtService
|
||||||
|
) {}
|
||||||
|
|
||||||
|
async canActivate(context: ExecutionContext): Promise<boolean> {
|
||||||
|
const request = context.switchToHttp().getRequest<Request>();
|
||||||
|
|
||||||
|
try {
|
||||||
|
// Récupère ou rafraîchit le token client
|
||||||
|
const token = await this.tokenService.getToken();
|
||||||
|
request['accessToken'] = token;
|
||||||
|
|
||||||
|
// Décodage JWT avec JwtService (ne vérifie pas la signature côté client)
|
||||||
|
const payload: any = this.jwtService.decode(token);
|
||||||
|
if (!payload) {
|
||||||
|
this.logger.warn('Token could not be decoded');
|
||||||
|
throw new UnauthorizedException('Invalid token');
|
||||||
|
}
|
||||||
|
|
||||||
|
const roles: string[] = payload.realm_access?.roles || [];
|
||||||
|
|
||||||
|
// Vérification facultative des rôles spécifiés via metadata
|
||||||
|
const requiredRoles = this.getRequiredRoles(context);
|
||||||
|
if (requiredRoles.length > 0) {
|
||||||
|
const hasRole = requiredRoles.some(role => roles.includes(role));
|
||||||
|
if (!hasRole) {
|
||||||
|
this.logger.warn(`Access denied, missing required roles: ${requiredRoles}`);
|
||||||
|
throw new ForbiddenException('Insufficient service role');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
} catch (err: any) {
|
||||||
|
this.logger.error('Client credentials guard failed: ' + (err?.message ?? err));
|
||||||
|
if (err instanceof ForbiddenException) throw err;
|
||||||
|
throw new UnauthorizedException('Service authentication failed');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Récupère les rôles requis définis via un décorateur @Roles() sur le handler.
|
||||||
|
*/
|
||||||
|
private getRequiredRoles(context: ExecutionContext): string[] {
|
||||||
|
const handler = context.getHandler();
|
||||||
|
return Reflect.getMetadata('roles', handler) || [];
|
||||||
|
}
|
||||||
|
}
|
||||||
68
src/auth/guards/user-auth.guard.ts
Normal file
68
src/auth/guards/user-auth.guard.ts
Normal file
@ -0,0 +1,68 @@
|
|||||||
|
import {
|
||||||
|
CanActivate,
|
||||||
|
ExecutionContext,
|
||||||
|
Injectable,
|
||||||
|
UnauthorizedException,
|
||||||
|
Logger,
|
||||||
|
} from '@nestjs/common';
|
||||||
|
import { JwtService } from '@nestjs/jwt';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class UserAuthGuard implements CanActivate {
|
||||||
|
private readonly logger = new Logger(UserAuthGuard.name);
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly jwtService: JwtService,
|
||||||
|
private readonly configService: ConfigService,
|
||||||
|
) {}
|
||||||
|
|
||||||
|
canActivate(context: ExecutionContext): boolean {
|
||||||
|
const request = context.switchToHttp().getRequest();
|
||||||
|
|
||||||
|
// Vérifie la présence du header Authorization
|
||||||
|
const authHeader = request.headers['authorization'];
|
||||||
|
if (!authHeader) {
|
||||||
|
throw new UnauthorizedException('Authorization header missing');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Extraction du token
|
||||||
|
const [type, token] = authHeader.split(' ');
|
||||||
|
if (type !== 'Bearer' || !token) {
|
||||||
|
throw new UnauthorizedException('Invalid or missing Bearer token');
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
// Récupère la clé publique Keycloak
|
||||||
|
const publicKey = this.configService.get<string>('keycloak.publicKey');
|
||||||
|
if (!publicKey) {
|
||||||
|
throw new Error('Keycloak public key not configured');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Vérifie et décode le token
|
||||||
|
const payload = this.jwtService.verify(token, {
|
||||||
|
algorithms: ['RS256'],
|
||||||
|
publicKey: this.formatPublicKey(publicKey),
|
||||||
|
});
|
||||||
|
|
||||||
|
// Vérifie que le token appartient bien à ton realm Keycloak
|
||||||
|
const expectedIssuer = `${this.configService.get<string>('keycloak.serverUrl')}/realms/${this.configService.get<string>('keycloak.realm')}`;
|
||||||
|
if (payload.iss !== expectedIssuer) {
|
||||||
|
throw new UnauthorizedException('Invalid token issuer');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Attache le payload utilisateur à la requête
|
||||||
|
request.user = payload;
|
||||||
|
return true;
|
||||||
|
|
||||||
|
} catch (err: any) {
|
||||||
|
this.logger.error(`UserAuthGuard failed: ${err?.message}`);
|
||||||
|
throw new UnauthorizedException('Invalid or expired token');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private formatPublicKey(key: string): string {
|
||||||
|
if (key.includes('BEGIN PUBLIC KEY')) return key;
|
||||||
|
return `-----BEGIN PUBLIC KEY-----\n${key}\n-----END PUBLIC KEY-----`;
|
||||||
|
}
|
||||||
|
}
|
||||||
385
src/auth/services/keycloak-api.service.ts
Normal file
385
src/auth/services/keycloak-api.service.ts
Normal file
@ -0,0 +1,385 @@
|
|||||||
|
import { Injectable, Logger, HttpException, NotFoundException } from '@nestjs/common';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
import { HttpService } from '@nestjs/axios';
|
||||||
|
import { AxiosResponse } from 'axios';
|
||||||
|
import { firstValueFrom, timeout as rxjsTimeout } from 'rxjs';
|
||||||
|
import { TokenService } from './token.service';
|
||||||
|
import jwtDecode from 'jwt-decode';
|
||||||
|
import { KeycloakConfig } from '../../config/keycloak.config';
|
||||||
|
|
||||||
|
interface DecodedToken {
|
||||||
|
sub: string;
|
||||||
|
preferred_username?: string;
|
||||||
|
email?: string;
|
||||||
|
given_name?: string;
|
||||||
|
family_name?: string;
|
||||||
|
realm_access?: { roles: string[] };
|
||||||
|
resource_access?: Record<string, { roles: string[] }>;
|
||||||
|
scope?: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class KeycloakApiService {
|
||||||
|
private readonly logger = new Logger(KeycloakApiService.name);
|
||||||
|
private readonly keycloakBaseUrl: string;
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly httpService: HttpService,
|
||||||
|
private readonly tokenService: TokenService,
|
||||||
|
private readonly configService: ConfigService,
|
||||||
|
) {
|
||||||
|
this.keycloakBaseUrl = this.configService.get<string>('keycloak.serverUrl')
|
||||||
|
|| 'https://keycloak-dcb.app.cameleonapp.com';
|
||||||
|
}
|
||||||
|
|
||||||
|
async request<T>(
|
||||||
|
method: 'GET' | 'POST' | 'PUT' | 'DELETE',
|
||||||
|
url: string,
|
||||||
|
data?: any,
|
||||||
|
opts?: { timeoutMs?: number },
|
||||||
|
): Promise<T> {
|
||||||
|
const token = await this.tokenService.getToken();
|
||||||
|
const config = {
|
||||||
|
headers: {
|
||||||
|
Authorization: `Bearer ${token}`,
|
||||||
|
'Content-Type': 'application/json',
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
try {
|
||||||
|
let obs;
|
||||||
|
const timeoutMs = opts?.timeoutMs ?? 5000;
|
||||||
|
|
||||||
|
switch (method) {
|
||||||
|
case 'GET':
|
||||||
|
obs = this.httpService.get<T>(url, config);
|
||||||
|
break;
|
||||||
|
case 'POST':
|
||||||
|
obs = this.httpService.post<T>(url, data, config);
|
||||||
|
break;
|
||||||
|
case 'PUT':
|
||||||
|
obs = this.httpService.put<T>(url, data, config);
|
||||||
|
break;
|
||||||
|
case 'DELETE':
|
||||||
|
obs = this.httpService.delete<T>(url, config);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
throw new Error(`Unsupported HTTP method: ${method}`);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
const response: AxiosResponse<T> = await firstValueFrom(obs.pipe(rxjsTimeout(timeoutMs)));
|
||||||
|
return response.data;
|
||||||
|
|
||||||
|
} catch (err: unknown) {
|
||||||
|
const error = err as any;
|
||||||
|
const urlWithoutToken = this.sanitizeUrl(url);
|
||||||
|
|
||||||
|
let errorMessage = `Request to ${urlWithoutToken} failed`;
|
||||||
|
|
||||||
|
if (error?.response) {
|
||||||
|
errorMessage += `: ${error.response.status} ${error.response.statusText}`;
|
||||||
|
|
||||||
|
// Gestion spécifique des erreurs 404
|
||||||
|
if (error.response.status === 404) {
|
||||||
|
throw new NotFoundException(`Resource not found: ${urlWithoutToken}`);
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.error(`HTTP Error for ${method} ${urlWithoutToken}`, {
|
||||||
|
status: error.response.status,
|
||||||
|
data: error.response.data,
|
||||||
|
});
|
||||||
|
} else if (error?.message) {
|
||||||
|
errorMessage += `: ${error.message}`;
|
||||||
|
this.logger.error(`Network error for ${method} ${urlWithoutToken}`);
|
||||||
|
} else {
|
||||||
|
errorMessage += `: Unknown error`;
|
||||||
|
this.logger.error(`Unknown error for ${method} ${urlWithoutToken}`);
|
||||||
|
}
|
||||||
|
|
||||||
|
throw new HttpException(errorMessage, error?.response?.status || 500);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private sanitizeUrl(url: string): string {
|
||||||
|
return url.replace(/\/[0-9a-fA-F-]{36}\//g, '/***/');
|
||||||
|
}
|
||||||
|
|
||||||
|
private buildKeycloakUrl(path: string): string {
|
||||||
|
return `${this.keycloakBaseUrl}${path.startsWith('/') ? path : `/${path}`}`;
|
||||||
|
}
|
||||||
|
|
||||||
|
// === REALM OPERATIONS ===
|
||||||
|
async getRealmClients(realm: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/clients`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async getRealmInfo(realm: string): Promise<any> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}`);
|
||||||
|
return this.request<any>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
// === USER OPERATIONS ===
|
||||||
|
async getUserById(realm: string, userId: string): Promise<any> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}`);
|
||||||
|
return this.request<any>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
private decodeJwt<T>(token: string): T {
|
||||||
|
if (!token) throw new Error('Token is required');
|
||||||
|
const payload = token.split('.')[1];
|
||||||
|
if (!payload) throw new Error('Invalid JWT token');
|
||||||
|
const decodedJson = Buffer.from(payload, 'base64').toString('utf-8');
|
||||||
|
return JSON.parse(decodedJson) as T;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Récupère le profil utilisateur.
|
||||||
|
* Offline validation → décodage JWT
|
||||||
|
* Fallback → Keycloak /userinfo
|
||||||
|
*/
|
||||||
|
async getUserProfile(realm: string, accessToken: string): Promise<any> {
|
||||||
|
// --- 1. Décodage du token (offline) ---
|
||||||
|
try {
|
||||||
|
const decoded: DecodedToken = this.decodeJwt<DecodedToken>(accessToken);
|
||||||
|
if (!decoded?.sub) throw new HttpException('Invalid token', 401);
|
||||||
|
|
||||||
|
const resourceRoles = decoded.resource_access?.['dcb-user-service-pwd']?.roles || [];
|
||||||
|
const realmRoles = decoded.realm_access?.roles || [];
|
||||||
|
|
||||||
|
return {
|
||||||
|
sub: decoded.sub,
|
||||||
|
username: decoded.preferred_username,
|
||||||
|
email: decoded.email,
|
||||||
|
given_name: decoded.given_name,
|
||||||
|
family_name: decoded.family_name,
|
||||||
|
roles: [...realmRoles, ...resourceRoles],
|
||||||
|
scope: decoded.scope,
|
||||||
|
};
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.warn(`Offline token decoding failed: ${error.message}. Falling back to /userinfo.`);
|
||||||
|
}
|
||||||
|
|
||||||
|
// --- 2. Fallback : Appel Keycloak /userinfo ---
|
||||||
|
try {
|
||||||
|
const url = `${this.keycloakBaseUrl}/realms/${realm}/protocol/openid-connect/userinfo`;
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService.get(url, {
|
||||||
|
headers: { Authorization: `Bearer ${accessToken}` },
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
|
||||||
|
return response.data;
|
||||||
|
} catch (error: any) {
|
||||||
|
const status = error.response?.status || 500;
|
||||||
|
const data = error.response?.data || error.message;
|
||||||
|
|
||||||
|
this.logger.error(`Failed to fetch user profile from Keycloak: ${status}`, data);
|
||||||
|
if (status === 401) throw new HttpException('Invalid or expired token', 401);
|
||||||
|
|
||||||
|
throw new HttpException('Failed to fetch user profile', status);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUsers(realm: string, queryParams?: {
|
||||||
|
briefRepresentation?: boolean;
|
||||||
|
email?: string;
|
||||||
|
first?: number;
|
||||||
|
firstName?: string;
|
||||||
|
lastName?: string;
|
||||||
|
max?: number;
|
||||||
|
search?: string;
|
||||||
|
username?: string;
|
||||||
|
}): Promise<any[]> {
|
||||||
|
let url = this.buildKeycloakUrl(`/admin/realms/${realm}/users`);
|
||||||
|
|
||||||
|
// Ajouter les paramètres de query s'ils sont fournis
|
||||||
|
if (queryParams) {
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
Object.entries(queryParams).forEach(([key, value]) => {
|
||||||
|
if (value !== undefined && value !== null) {
|
||||||
|
params.append(key, value.toString());
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
const queryString = params.toString();
|
||||||
|
if (queryString) {
|
||||||
|
url += `?${queryString}`;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async createUser(realm: string, user: any): Promise<any> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users`);
|
||||||
|
return this.request<any>('POST', url, user);
|
||||||
|
}
|
||||||
|
|
||||||
|
async updateUser(realm: string, userId: string, data: any): Promise<any> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}`);
|
||||||
|
return this.request<any>('PUT', url, data);
|
||||||
|
}
|
||||||
|
|
||||||
|
async deleteUser(realm: string, userId: string): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}`);
|
||||||
|
await this.request<void>('DELETE', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === ROLE OPERATIONS ===
|
||||||
|
async getRealmRoles(realm: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/roles`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserRealmRoles(realm: string, userId: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/role-mappings/realm`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async assignRealmRoles(realm: string, userId: string, roles: any[]): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/role-mappings/realm`);
|
||||||
|
|
||||||
|
// S'assurer que les rôles sont au format attendu par Keycloak
|
||||||
|
const rolesToAssign = roles.map(role => {
|
||||||
|
if (typeof role === 'string') {
|
||||||
|
return { id: role, name: role };
|
||||||
|
}
|
||||||
|
return role;
|
||||||
|
});
|
||||||
|
|
||||||
|
return this.request<void>('POST', url, rolesToAssign);
|
||||||
|
}
|
||||||
|
|
||||||
|
async removeRealmRoles(realm: string, userId: string, roles: any[]): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/role-mappings/realm`);
|
||||||
|
|
||||||
|
// S'assurer que les rôles sont au format attendu par Keycloak
|
||||||
|
const rolesToRemove = roles.map(role => {
|
||||||
|
if (typeof role === 'string') {
|
||||||
|
return { id: role, name: role };
|
||||||
|
}
|
||||||
|
return role;
|
||||||
|
});
|
||||||
|
|
||||||
|
return this.request<void>('DELETE', url, rolesToRemove);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === PASSWORD OPERATIONS ===
|
||||||
|
async resetPassword(realm: string, userId: string, newPassword: string, temporary: boolean = true): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/reset-password`);
|
||||||
|
|
||||||
|
const credentials = {
|
||||||
|
type: 'password',
|
||||||
|
value: newPassword,
|
||||||
|
temporary: temporary,
|
||||||
|
};
|
||||||
|
|
||||||
|
return this.request<void>('PUT', url, credentials);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === GROUP OPERATIONS ===
|
||||||
|
async getUserGroups(realm: string, userId: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/groups`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async addUserToGroup(realm: string, userId: string, groupId: string): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/groups/${groupId}`);
|
||||||
|
return this.request<void>('PUT', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async removeUserFromGroup(realm: string, userId: string, groupId: string): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/groups/${groupId}`);
|
||||||
|
return this.request<void>('DELETE', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === CLIENT OPERATIONS ===
|
||||||
|
async getClientRoles(realm: string, clientId: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/clients/${clientId}/roles`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserClientRoles(realm: string, userId: string, clientId: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/role-mappings/clients/${clientId}`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === SESSION OPERATIONS ===
|
||||||
|
async getUserSessions(realm: string, userId: string): Promise<any[]> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/sessions`);
|
||||||
|
return this.request<any[]>('GET', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
async logoutUser(realm: string, userId: string): Promise<void> {
|
||||||
|
const url = this.buildKeycloakUrl(`/admin/realms/${realm}/users/${userId}/logout`);
|
||||||
|
return this.request<void>('POST', url);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === SEARCH OPERATIONS ===
|
||||||
|
async searchUsers(realm: string, search: string, maxResults: number = 50): Promise<any[]> {
|
||||||
|
const users = await this.getUsers(realm, { search, max: maxResults });
|
||||||
|
return users;
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserByUsername(realm: string, username: string): Promise<any> {
|
||||||
|
const users = await this.getUsers(realm, { username, max: 1 });
|
||||||
|
return users.length > 0 ? users[0] : null;
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserByEmail(realm: string, email: string): Promise<any> {
|
||||||
|
const users = await this.getUsers(realm, { email, max: 1 });
|
||||||
|
return users.length > 0 ? users[0] : null;
|
||||||
|
}
|
||||||
|
|
||||||
|
// === BULK OPERATIONS ===
|
||||||
|
async updateUserAttributes(realm: string, userId: string, attributes: Record<string, any>): Promise<void> {
|
||||||
|
const user = await this.getUserById(realm, userId);
|
||||||
|
|
||||||
|
const updateData = {
|
||||||
|
...user,
|
||||||
|
attributes: {
|
||||||
|
...user.attributes,
|
||||||
|
...attributes,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
await this.updateUser(realm, userId, updateData);
|
||||||
|
}
|
||||||
|
|
||||||
|
async disableUser(realm: string, userId: string): Promise<void> {
|
||||||
|
await this.updateUser(realm, userId, { enabled: false });
|
||||||
|
}
|
||||||
|
|
||||||
|
async enableUser(realm: string, userId: string): Promise<void> {
|
||||||
|
await this.updateUser(realm, userId, { enabled: true });
|
||||||
|
}
|
||||||
|
|
||||||
|
// === HEALTH CHECK ===
|
||||||
|
async checkHealth(): Promise<{ status: string; realm: string }> {
|
||||||
|
try {
|
||||||
|
const realm = this.configService.get<string>('keycloak.realm');
|
||||||
|
|
||||||
|
if (!realm) {
|
||||||
|
throw new Error('Keycloak configuration not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Test basique de connexion
|
||||||
|
await this.getRealmInfo(realm);
|
||||||
|
|
||||||
|
return {
|
||||||
|
status: 'healthy',
|
||||||
|
realm
|
||||||
|
};
|
||||||
|
} catch (error) {
|
||||||
|
this.logger.error('Keycloak health check failed', error);
|
||||||
|
return {
|
||||||
|
status: 'unhealthy',
|
||||||
|
realm: 'unknown'
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
47
src/auth/services/startup.service.ts
Normal file
47
src/auth/services/startup.service.ts
Normal file
@ -0,0 +1,47 @@
|
|||||||
|
import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
|
||||||
|
import { TokenService } from './token.service';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class StartupService implements OnModuleInit {
|
||||||
|
private readonly logger = new Logger(StartupService.name);
|
||||||
|
private isInitialized = false;
|
||||||
|
private initializationError: string | null = null;
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly tokenService: TokenService,
|
||||||
|
private readonly configService: ConfigService,
|
||||||
|
) {}
|
||||||
|
|
||||||
|
async onModuleInit() {
|
||||||
|
this.logger.log('Starting Keycloak connection...');
|
||||||
|
|
||||||
|
try {
|
||||||
|
// Test simple : acquisition du token admin
|
||||||
|
await this.tokenService.getToken();
|
||||||
|
this.isInitialized = true;
|
||||||
|
this.logger.log('✅ Keycloak connection established successfully');
|
||||||
|
} catch (error) {
|
||||||
|
this.initializationError = error.message;
|
||||||
|
this.logger.error('❌ Keycloak connection failed', error);
|
||||||
|
// On ne throw pas l'erreur pour permettre à l'app de démarrer
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
getStatus() {
|
||||||
|
return {
|
||||||
|
status: this.isInitialized ? 'healthy' : 'unhealthy',
|
||||||
|
keycloak: {
|
||||||
|
connected: this.isInitialized,
|
||||||
|
realm: this.configService.get('keycloak.realm'),
|
||||||
|
serverUrl: this.configService.get('keycloak.serverUrl'),
|
||||||
|
},
|
||||||
|
timestamp: new Date(),
|
||||||
|
error: this.initializationError,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
isHealthy(): boolean {
|
||||||
|
return this.isInitialized;
|
||||||
|
}
|
||||||
|
}
|
||||||
268
src/auth/services/token.service copy.ts
Normal file
268
src/auth/services/token.service copy.ts
Normal file
@ -0,0 +1,268 @@
|
|||||||
|
import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
import { HttpService } from '@nestjs/axios';
|
||||||
|
import { firstValueFrom, timeout as rxjsTimeout } from 'rxjs';
|
||||||
|
|
||||||
|
export interface KeycloakTokenResponse {
|
||||||
|
access_token: string;
|
||||||
|
expires_in: number;
|
||||||
|
refresh_token?: string;
|
||||||
|
token_type: string;
|
||||||
|
scope?: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class TokenService implements OnModuleInit {
|
||||||
|
private readonly logger = new Logger(TokenService.name);
|
||||||
|
|
||||||
|
private currentToken: string | null = null;
|
||||||
|
private tokenExpiry: Date | null = null;
|
||||||
|
private acquiringTokenPromise: Promise<string> | null = null;
|
||||||
|
|
||||||
|
// Mapping access_token → refresh_token pour gérer les logouts utilisateurs
|
||||||
|
private userRefreshTokens = new Map<string, string>();
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly configService: ConfigService,
|
||||||
|
private readonly httpService: HttpService,
|
||||||
|
) {}
|
||||||
|
|
||||||
|
async onModuleInit() {
|
||||||
|
try {
|
||||||
|
await this.acquireClientToken();
|
||||||
|
} catch {
|
||||||
|
this.logger.warn('Initial Keycloak client token acquisition failed (will retry on demand).');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private getTokenUrl(): string {
|
||||||
|
const serverUrl = this.configService.get<string>('keycloak.serverUrl');
|
||||||
|
const realm = this.configService.get<string>('keycloak.realm');
|
||||||
|
|
||||||
|
if (!serverUrl || !realm) {
|
||||||
|
throw new Error('Keycloak serverUrl or realm not configured');
|
||||||
|
}
|
||||||
|
|
||||||
|
return `${serverUrl}/realms/${realm}/protocol/openid-connect/token`;
|
||||||
|
}
|
||||||
|
|
||||||
|
getAccessTokenFromHeader(request: Request): string | null {
|
||||||
|
const authHeader = request.headers['authorization'];
|
||||||
|
if (!authHeader) return null;
|
||||||
|
const [type, token] = authHeader.split(' ');
|
||||||
|
return type === 'Bearer' ? token : null;
|
||||||
|
}
|
||||||
|
|
||||||
|
private getLogoutUrl(): string {
|
||||||
|
const serverUrl = this.configService.get<string>('keycloak.serverUrl');
|
||||||
|
const realm = this.configService.get<string>('keycloak.realm');
|
||||||
|
return `${serverUrl}/realms/${realm}/protocol/openid-connect/logout`;
|
||||||
|
}
|
||||||
|
|
||||||
|
private validateClientConfig(): { clientId: string; clientSecret: string } {
|
||||||
|
const clientId = this.configService.get<string>('keycloak.clientId');
|
||||||
|
const clientSecret = this.configService.get<string>('keycloak.clientSecret');
|
||||||
|
|
||||||
|
if (!clientId) throw new Error('KEYCLOAK_CLIENT_ID is not configured');
|
||||||
|
if (!clientSecret) throw new Error('KEYCLOAK_CLIENT_SECRET is not configured');
|
||||||
|
|
||||||
|
return { clientId, clientSecret };
|
||||||
|
}
|
||||||
|
|
||||||
|
private validateUserClientConfig(): { userClientId: string; userClientSecret: string } {
|
||||||
|
const userClientId = this.configService.get<string>('keycloak.userClientId');
|
||||||
|
const userClientSecret = this.configService.get<string>('keycloak.userClientSecret');
|
||||||
|
|
||||||
|
if (!userClientId) throw new Error('KEYCLOAK_CLIENT_ID is not configured');
|
||||||
|
if (!userClientSecret) throw new Error('KEYCLOAK_CLIENT_SECRET is not configured');
|
||||||
|
|
||||||
|
return { userClientId, userClientSecret };
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* CLIENT CREDENTIALS TOKEN
|
||||||
|
* ------------------------------- */
|
||||||
|
async acquireClientToken(): Promise<string> {
|
||||||
|
if (this.acquiringTokenPromise) return this.acquiringTokenPromise;
|
||||||
|
|
||||||
|
this.acquiringTokenPromise = (async () => {
|
||||||
|
try {
|
||||||
|
const tokenUrl = this.getTokenUrl();
|
||||||
|
const { clientId, clientSecret } = this.validateClientConfig();
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('grant_type', 'client_credentials');
|
||||||
|
params.append('client_id', clientId);
|
||||||
|
params.append('client_secret', clientSecret);
|
||||||
|
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService
|
||||||
|
.post<KeycloakTokenResponse>(tokenUrl, params.toString(), {
|
||||||
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||||
|
})
|
||||||
|
.pipe(rxjsTimeout(10000)),
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!response?.data?.access_token) throw new Error('No access_token in Keycloak response');
|
||||||
|
|
||||||
|
this.currentToken = response.data.access_token;
|
||||||
|
const expiresIn = response.data.expires_in ?? 60;
|
||||||
|
const buffer = this.configService.get<number>('keycloak.tokenBufferSeconds') ?? 30;
|
||||||
|
|
||||||
|
const expiry = new Date();
|
||||||
|
expiry.setSeconds(expiry.getSeconds() + Math.max(0, expiresIn - buffer));
|
||||||
|
this.tokenExpiry = expiry;
|
||||||
|
|
||||||
|
this.logger.log(`Acquired Keycloak client token (expires in ${expiresIn}s)`);
|
||||||
|
return this.currentToken;
|
||||||
|
} finally {
|
||||||
|
this.acquiringTokenPromise = null;
|
||||||
|
}
|
||||||
|
})();
|
||||||
|
|
||||||
|
return this.acquiringTokenPromise;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* USER PASSWORD TOKEN (ROPC)
|
||||||
|
* ------------------------------- */
|
||||||
|
async acquireUserToken(username: string, password: string): Promise<KeycloakTokenResponse> {
|
||||||
|
const tokenUrl = this.getTokenUrl();
|
||||||
|
const { userClientId, userClientSecret } = this.validateUserClientConfig();
|
||||||
|
|
||||||
|
if (!username || !password) throw new Error('Username and password are required');
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('grant_type', 'password');
|
||||||
|
params.append('client_id', userClientId);
|
||||||
|
params.append('client_secret', userClientSecret);
|
||||||
|
params.append('username', username);
|
||||||
|
params.append('password', password);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService
|
||||||
|
.post<KeycloakTokenResponse>(tokenUrl, params.toString(), {
|
||||||
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||||
|
})
|
||||||
|
.pipe(rxjsTimeout(10000)),
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!response?.data?.access_token) throw new Error('No access_token in Keycloak response');
|
||||||
|
|
||||||
|
// 🔹 Stocke le refresh_token associé
|
||||||
|
if (response.data.refresh_token) {
|
||||||
|
this.userRefreshTokens.set(response.data.access_token, response.data.refresh_token);
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.log(`User token acquired for "${username}"`);
|
||||||
|
return response.data;
|
||||||
|
} catch (err: any) {
|
||||||
|
this.logger.error(`Failed to acquire Keycloak user token: ${err?.message ?? err}`);
|
||||||
|
throw new Error('Invalid username or password');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* REFRESH TOKEN
|
||||||
|
* ------------------------------- */
|
||||||
|
async refreshToken(refreshToken: string): Promise<KeycloakTokenResponse> {
|
||||||
|
const tokenUrl = this.getTokenUrl();
|
||||||
|
|
||||||
|
const { userClientId, userClientSecret } = this.validateUserClientConfig();
|
||||||
|
|
||||||
|
if (!refreshToken) throw new Error('Refresh token is required');
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('grant_type', 'refresh_token');
|
||||||
|
params.append('client_id', userClientId);
|
||||||
|
params.append('client_secret', userClientSecret);
|
||||||
|
params.append('refresh_token', refreshToken);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService
|
||||||
|
.post<KeycloakTokenResponse>(tokenUrl, params.toString(), {
|
||||||
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||||
|
})
|
||||||
|
.pipe(rxjsTimeout(10000))
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!response?.data?.access_token) throw new Error('No access_token in Keycloak response');
|
||||||
|
|
||||||
|
// Met à jour le mapping
|
||||||
|
if (response.data.refresh_token) {
|
||||||
|
this.userRefreshTokens.set(response.data.access_token, response.data.refresh_token);
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.log('Token refreshed successfully');
|
||||||
|
return response.data;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to refresh token: ${error.message}`);
|
||||||
|
throw new Error('Failed to refresh token');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* REVOKE TOKEN (LOGOUT)
|
||||||
|
* ------------------------------- */
|
||||||
|
async revokeToken(refreshToken: string): Promise<void> {
|
||||||
|
const logoutUrl = this.getLogoutUrl();
|
||||||
|
const clientId = this.configService.get<string>('keycloak.userClientId');
|
||||||
|
const clientSecret = this.configService.get<string>('keycloak.userClientSecret');
|
||||||
|
|
||||||
|
if (!clientId || !clientSecret) throw new Error('ClientId or ClientSecret not configured');
|
||||||
|
if (!refreshToken) throw new Error('Refresh token is required');
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('client_id', clientId);
|
||||||
|
params.append('client_secret', clientSecret);
|
||||||
|
params.append('refresh_token', refreshToken);
|
||||||
|
|
||||||
|
try {
|
||||||
|
await firstValueFrom(
|
||||||
|
this.httpService
|
||||||
|
.post(logoutUrl, params.toString(), {
|
||||||
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||||
|
})
|
||||||
|
.pipe(rxjsTimeout(10000)),
|
||||||
|
);
|
||||||
|
|
||||||
|
this.logger.log(`Refresh token revoked successfully`);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.warn(`Failed to revoke refresh token: ${error.message}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** -------------------------------
|
||||||
|
* HELPER METHODS
|
||||||
|
* ------------------------------- */
|
||||||
|
async getToken(): Promise<string> {
|
||||||
|
if (this.isTokenValid()) return this.currentToken!;
|
||||||
|
return this.acquireClientToken();
|
||||||
|
}
|
||||||
|
|
||||||
|
isTokenValid(): boolean {
|
||||||
|
return !!this.currentToken && !!this.tokenExpiry && new Date() < this.tokenExpiry;
|
||||||
|
}
|
||||||
|
|
||||||
|
clearToken(): void {
|
||||||
|
this.currentToken = null;
|
||||||
|
this.tokenExpiry = null;
|
||||||
|
}
|
||||||
|
|
||||||
|
async getStoredRefreshToken(accessToken: string): Promise<string | null> {
|
||||||
|
return this.userRefreshTokens.get(accessToken) ?? null;
|
||||||
|
}
|
||||||
|
|
||||||
|
getTokenInfo() {
|
||||||
|
if (!this.currentToken) return null;
|
||||||
|
return {
|
||||||
|
isValid: this.isTokenValid(),
|
||||||
|
expiresAt: this.tokenExpiry,
|
||||||
|
expiresIn: this.tokenExpiry
|
||||||
|
? Math.floor((this.tokenExpiry.getTime() - new Date().getTime()) / 1000)
|
||||||
|
: 0,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
269
src/auth/services/token.service.ts
Normal file
269
src/auth/services/token.service.ts
Normal file
@ -0,0 +1,269 @@
|
|||||||
|
import { Injectable, Logger } from '@nestjs/common';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
import { HttpService } from '@nestjs/axios';
|
||||||
|
import { firstValueFrom } from 'rxjs';
|
||||||
|
import { KeycloakConfig } from '../../config/keycloak.config';
|
||||||
|
import * as jwt from 'jsonwebtoken';
|
||||||
|
|
||||||
|
export interface KeycloakTokenResponse {
|
||||||
|
access_token: string;
|
||||||
|
|
||||||
|
refresh_token?: string;
|
||||||
|
expires_in: number;
|
||||||
|
token_type: string;
|
||||||
|
scope?: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class TokenService {
|
||||||
|
private readonly logger = new Logger(TokenService.name);
|
||||||
|
|
||||||
|
private currentToken: string | null = null;
|
||||||
|
private tokenExpiry: Date | null = null;
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private configService: ConfigService,
|
||||||
|
private httpService: HttpService,
|
||||||
|
) {}
|
||||||
|
|
||||||
|
// === POUR L'API ADMIN (KeycloakApiService) - Client Credentials ===
|
||||||
|
async getToken(): Promise<string> {
|
||||||
|
// Si nous avons un token valide, le retourner
|
||||||
|
if (this.currentToken && this.isTokenValid()) {
|
||||||
|
return this.currentToken;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Sinon, acquérir un nouveau token en utilisant client_credentials
|
||||||
|
return await this.acquireClientCredentialsToken();
|
||||||
|
}
|
||||||
|
|
||||||
|
private async acquireClientCredentialsToken(): Promise<string> {
|
||||||
|
const keycloakConfig = this.configService.get<KeycloakConfig>('keycloak');
|
||||||
|
|
||||||
|
if (!keycloakConfig) {
|
||||||
|
throw new Error('Keycloak configuration not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
const tokenEndpoint = `${keycloakConfig.serverUrl}/realms/${keycloakConfig.realm}/protocol/openid-connect/token`;
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('grant_type', 'client_credentials');
|
||||||
|
params.append('client_id', keycloakConfig.adminClientId); // ← Client admin
|
||||||
|
params.append('client_secret', keycloakConfig.adminClientSecret); // ← Secret admin
|
||||||
|
|
||||||
|
try {
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService.post<KeycloakTokenResponse>(tokenEndpoint, params, {
|
||||||
|
headers: {
|
||||||
|
'Content-Type': 'application/x-www-form-urlencoded',
|
||||||
|
},
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
// Stocker le token et sa date d'expiration
|
||||||
|
this.currentToken = response.data.access_token;
|
||||||
|
this.tokenExpiry = new Date(Date.now() + (response.data.expires_in * 1000));
|
||||||
|
|
||||||
|
this.logger.log('Successfully acquired client credentials token');
|
||||||
|
return this.currentToken;
|
||||||
|
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Failed to acquire client token', error.response?.data);
|
||||||
|
throw new Error(error.response?.data?.error_description || 'Failed to acquire client token');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private isTokenValid(): boolean {
|
||||||
|
if (!this.currentToken || !this.tokenExpiry) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Ajouter un buffer de sécurité (30 secondes par défaut)
|
||||||
|
const bufferSeconds = this.configService.get<number>('keycloak.tokenBufferSeconds') || 30;
|
||||||
|
const bufferMs = bufferSeconds * 1000;
|
||||||
|
|
||||||
|
return this.tokenExpiry.getTime() > (Date.now() + bufferMs);
|
||||||
|
}
|
||||||
|
|
||||||
|
// === POUR L'AUTHENTIFICATION UTILISATEUR (AuthController) - Password Grant ===
|
||||||
|
async acquireUserToken(username: string, password: string): Promise<KeycloakTokenResponse> {
|
||||||
|
const keycloakConfig = this.configService.get<KeycloakConfig>('keycloak');
|
||||||
|
|
||||||
|
if (!keycloakConfig) {
|
||||||
|
throw new Error('Keycloak configuration not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
const tokenEndpoint = `${keycloakConfig.serverUrl}/realms/${keycloakConfig.realm}/protocol/openid-connect/token`;
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('grant_type', 'password');
|
||||||
|
params.append('client_id', keycloakConfig.authClientId); // ← Client auth
|
||||||
|
params.append('client_secret', keycloakConfig.authClientSecret); // ← Secret auth
|
||||||
|
params.append('username', username);
|
||||||
|
params.append('password', password);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService.post<KeycloakTokenResponse>(tokenEndpoint, params, {
|
||||||
|
headers: {
|
||||||
|
'Content-Type': 'application/x-www-form-urlencoded',
|
||||||
|
},
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
this.logger.log(`User token acquired successfully for: ${username}`);
|
||||||
|
return response.data;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Failed to acquire user token', error.response?.data);
|
||||||
|
throw new Error(error.response?.data?.error_description || 'Authentication failed');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async refreshToken(refreshToken: string): Promise<KeycloakTokenResponse> {
|
||||||
|
const keycloakConfig = this.configService.get<KeycloakConfig>('keycloak');
|
||||||
|
|
||||||
|
if (!keycloakConfig) {
|
||||||
|
throw new Error('Keycloak configuration not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
const tokenEndpoint = `${keycloakConfig.serverUrl}/realms/${keycloakConfig.realm}/protocol/openid-connect/token`;
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('grant_type', 'refresh_token');
|
||||||
|
params.append('client_id', keycloakConfig.authClientId); // ← Utiliser le client auth pour le refresh
|
||||||
|
params.append('client_secret', keycloakConfig.authClientSecret);
|
||||||
|
params.append('refresh_token', refreshToken);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService.post<KeycloakTokenResponse>(tokenEndpoint, params, {
|
||||||
|
headers: {
|
||||||
|
'Content-Type': 'application/x-www-form-urlencoded',
|
||||||
|
},
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
return response.data;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Token refresh failed', error.response?.data);
|
||||||
|
throw new Error(error.response?.data?.error_description || 'Token refresh failed');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async revokeToken(token: string): Promise<void> {
|
||||||
|
const keycloakConfig = this.configService.get<KeycloakConfig>('keycloak');
|
||||||
|
|
||||||
|
if (!keycloakConfig) {
|
||||||
|
throw new Error('Keycloak configuration not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
const revokeEndpoint = `${keycloakConfig.serverUrl}/realms/${keycloakConfig.realm}/protocol/openid-connect/revoke`;
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
// Utiliser le client auth pour la révocation (car c'est généralement lié aux tokens utilisateur)
|
||||||
|
params.append('client_id', keycloakConfig.authClientId);
|
||||||
|
params.append('client_secret', keycloakConfig.authClientSecret);
|
||||||
|
params.append('token', token);
|
||||||
|
|
||||||
|
try {
|
||||||
|
await firstValueFrom(
|
||||||
|
this.httpService.post(revokeEndpoint, params, {
|
||||||
|
headers: {
|
||||||
|
'Content-Type': 'application/x-www-form-urlencoded',
|
||||||
|
},
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
this.logger.log('Token revoked successfully');
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Token revocation failed', error.response?.data);
|
||||||
|
throw new Error('Token revocation failed');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async validateOffline(token: string): Promise<boolean> {
|
||||||
|
const keycloakConfig = this.configService.get<KeycloakConfig>('keycloak');
|
||||||
|
|
||||||
|
if (!keycloakConfig?.publicKey) {
|
||||||
|
this.logger.error('Missing Keycloak public key for offline validation');
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const formattedKey = `-----BEGIN PUBLIC KEY-----\n${keycloakConfig.publicKey}\n-----END PUBLIC KEY-----`;
|
||||||
|
jwt.verify(token, formattedKey, {
|
||||||
|
algorithms: ['RS256'],
|
||||||
|
audience: keycloakConfig.authClientId,
|
||||||
|
});
|
||||||
|
return true;
|
||||||
|
} catch (err) {
|
||||||
|
this.logger.error('Offline token validation failed:', err.message);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
async validateToken(token: string): Promise<boolean> {
|
||||||
|
const mode = this.configService.get<string>('keycloak.validationMode') || 'online';
|
||||||
|
|
||||||
|
if (mode === 'offline') {
|
||||||
|
return this.validateOffline(token);
|
||||||
|
} else {
|
||||||
|
return this.validateOnline(token);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private async validateOnline(token: string): Promise<boolean> {
|
||||||
|
const keycloakConfig = this.configService.get<KeycloakConfig>('keycloak');
|
||||||
|
|
||||||
|
if (!keycloakConfig) {
|
||||||
|
throw new Error('Keycloak configuration not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
const introspectEndpoint = `${keycloakConfig.serverUrl}/realms/${keycloakConfig.realm}/protocol/openid-connect/token/introspect`;
|
||||||
|
|
||||||
|
const params = new URLSearchParams();
|
||||||
|
params.append('client_id', keycloakConfig.authClientId);
|
||||||
|
params.append('client_secret', keycloakConfig.authClientSecret);
|
||||||
|
params.append('token', token);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const response = await firstValueFrom(
|
||||||
|
this.httpService.post(introspectEndpoint, params, {
|
||||||
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||||
|
})
|
||||||
|
);
|
||||||
|
return response.data.active === true;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error('Online token validation failed', error.response?.data);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
async getStoredRefreshToken(accessToken: string): Promise<string | null> {
|
||||||
|
// Implémentez votre logique de stockage des refresh tokens ici
|
||||||
|
// Pour l'instant, retournez null ou implémentez selon vos besoins
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
// === MÉTHODES UTILITAIRES ===
|
||||||
|
clearToken(): void {
|
||||||
|
this.currentToken = null;
|
||||||
|
this.tokenExpiry = null;
|
||||||
|
this.logger.log('Admin client token cleared from cache');
|
||||||
|
}
|
||||||
|
|
||||||
|
getTokenInfo(): { hasToken: boolean; expiresIn?: number; clientType: string } {
|
||||||
|
if (!this.currentToken || !this.tokenExpiry) {
|
||||||
|
return { hasToken: false, clientType: 'admin' };
|
||||||
|
}
|
||||||
|
|
||||||
|
const expiresIn = this.tokenExpiry.getTime() - Date.now();
|
||||||
|
return {
|
||||||
|
hasToken: true,
|
||||||
|
expiresIn: Math.max(0, Math.floor(expiresIn / 1000)), // en secondes
|
||||||
|
clientType: 'admin'
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
109
src/config/keycloak.config.ts
Normal file
109
src/config/keycloak.config.ts
Normal file
@ -0,0 +1,109 @@
|
|||||||
|
import { registerAs } from '@nestjs/config';
|
||||||
|
import * as Joi from 'joi';
|
||||||
|
|
||||||
|
export interface KeycloakConfig {
|
||||||
|
serverUrl: string;
|
||||||
|
realm: string;
|
||||||
|
publicKey?: string;
|
||||||
|
// Client pour l'API Admin (Service Account - client_credentials)
|
||||||
|
adminClientId: string;
|
||||||
|
adminClientSecret: string;
|
||||||
|
// Client pour l'authentification utilisateur (Password Grant)
|
||||||
|
authClientId: string;
|
||||||
|
authClientSecret: string;
|
||||||
|
validationMode: string;
|
||||||
|
tokenBufferSeconds: number;
|
||||||
|
}
|
||||||
|
|
||||||
|
export default registerAs('keycloak', (): KeycloakConfig => ({
|
||||||
|
serverUrl: process.env.KEYCLOAK_SERVER_URL || 'https://keycloak-dcb.app.cameleonapp.com',
|
||||||
|
realm: process.env.KEYCLOAK_REALM || 'dcb-dev',
|
||||||
|
publicKey: process.env.KEYCLOAK_PUBLIC_KEY,
|
||||||
|
// Client pour Service Account (API Admin)
|
||||||
|
adminClientId: process.env.KEYCLOAK_ADMIN_CLIENT_ID || 'dcb-user-service-cc',
|
||||||
|
adminClientSecret: process.env.KEYCLOAK_ADMIN_CLIENT_SECRET || '',
|
||||||
|
// Client pour Password Grant (Authentification utilisateur)
|
||||||
|
authClientId: process.env.KEYCLOAK_AUTH_CLIENT_ID || 'dcb-user-service-pwd',
|
||||||
|
authClientSecret: process.env.KEYCLOAK_AUTH_CLIENT_SECRET || '',
|
||||||
|
validationMode: process.env.KEYCLOAK_VALIDATION_MODE || 'online',
|
||||||
|
tokenBufferSeconds: Number(process.env.KEYCLOAK_TOKEN_BUFFER_SECONDS) || 30,
|
||||||
|
}));
|
||||||
|
|
||||||
|
|
||||||
|
export const keycloakConfigValidationSchema = Joi.object({
|
||||||
|
KEYCLOAK_SERVER_URL: Joi.string()
|
||||||
|
.uri()
|
||||||
|
.required()
|
||||||
|
.messages({
|
||||||
|
'string.uri': 'KEYCLOAK_SERVER_URL must be a valid URL',
|
||||||
|
'any.required': 'KEYCLOAK_SERVER_URL is required'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_REALM: Joi.string()
|
||||||
|
.required()
|
||||||
|
.pattern(/^[a-zA-Z0-9_-]+$/)
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_REALM is required',
|
||||||
|
'string.pattern.base': 'KEYCLOAK_REALM can only contain letters, numbers, underscores and hyphens'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_PUBLIC_KEY: Joi.string()
|
||||||
|
.required()
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_PUBLIC_KEY is required'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_ADMIN_CLIENT_ID: Joi.string()
|
||||||
|
.required()
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_ADMIN_CLIENT_ID is required'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_ADMIN_CLIENT_SECRET: Joi.string()
|
||||||
|
.required()
|
||||||
|
.min(1)
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_ADMIN_CLIENT_SECRET is required',
|
||||||
|
'string.min': 'KEYCLOAK_ADMIN_CLIENT_SECRET cannot be empty'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_AUTH_CLIENT_ID: Joi.string()
|
||||||
|
.required()
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_AUTH_CLIENT_ID is required'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_AUTH_CLIENT_SECRET: Joi.string()
|
||||||
|
.required()
|
||||||
|
.min(1)
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_AUTH_CLIENT_SECRET is required',
|
||||||
|
'string.min': 'KEYCLOAK_AUTH_CLIENT_SECRET cannot be empty'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_VALIDATION_MODE: Joi.string()
|
||||||
|
.required()
|
||||||
|
.min(1)
|
||||||
|
.messages({
|
||||||
|
'any.required': 'KEYCLOAK_VALIDATION_MODE is required',
|
||||||
|
'string.min': 'KEYCLOAK_VALIDATION_MODE cannot be empty'
|
||||||
|
}),
|
||||||
|
|
||||||
|
KEYCLOAK_TOKEN_BUFFER_SECONDS: Joi.number()
|
||||||
|
.integer()
|
||||||
|
.min(0)
|
||||||
|
.max(300)
|
||||||
|
.default(30)
|
||||||
|
.messages({
|
||||||
|
'number.max': 'KEYCLOAK_TOKEN_BUFFER_SECONDS cannot exceed 300 seconds'
|
||||||
|
}),
|
||||||
|
|
||||||
|
// Variables d'environnement générales
|
||||||
|
NODE_ENV: Joi.string()
|
||||||
|
.valid('development', 'production', 'test', 'staging')
|
||||||
|
.default('development'),
|
||||||
|
|
||||||
|
PORT: Joi.number()
|
||||||
|
.port()
|
||||||
|
.default(3000),
|
||||||
|
}).unknown(true);
|
||||||
8
src/decorators/roles.decorator.ts
Normal file
8
src/decorators/roles.decorator.ts
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
import { SetMetadata } from '@nestjs/common';
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Décorateur custom pour définir les rôles requis sur une route.
|
||||||
|
* Exemple :
|
||||||
|
* @Roles('DCB_ADMIN', 'DCB_MANAGER')
|
||||||
|
*/
|
||||||
|
export const Roles = (...roles: string[]) => SetMetadata('roles', roles);
|
||||||
35
src/filters/keycloak-exception.filter.ts
Normal file
35
src/filters/keycloak-exception.filter.ts
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
import { ExceptionFilter, Catch, ArgumentsHost, HttpException, Logger } from '@nestjs/common';
|
||||||
|
import { Request, Response } from 'express';
|
||||||
|
|
||||||
|
@Catch()
|
||||||
|
export class KeycloakExceptionFilter implements ExceptionFilter {
|
||||||
|
private readonly logger = new Logger(KeycloakExceptionFilter.name);
|
||||||
|
|
||||||
|
catch(exception: unknown, host: ArgumentsHost) {
|
||||||
|
const ctx = host.switchToHttp();
|
||||||
|
const response = ctx.getResponse<Response>();
|
||||||
|
const request = ctx.getRequest<Request>();
|
||||||
|
|
||||||
|
let status = 500;
|
||||||
|
let message = 'Internal server error';
|
||||||
|
|
||||||
|
if (exception instanceof HttpException) {
|
||||||
|
status = exception.getStatus();
|
||||||
|
message = exception.message;
|
||||||
|
} else if (exception instanceof Error) {
|
||||||
|
message = exception.message;
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.error(
|
||||||
|
`Keycloak Client Credentials Error: ${message}`,
|
||||||
|
exception instanceof Error ? exception.stack : '',
|
||||||
|
);
|
||||||
|
|
||||||
|
response.status(status).json({
|
||||||
|
statusCode: status,
|
||||||
|
timestamp: new Date().toISOString(),
|
||||||
|
path: request.url,
|
||||||
|
message,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
32
src/health/health.controller.ts
Normal file
32
src/health/health.controller.ts
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
import { Controller, Get } from '@nestjs/common';
|
||||||
|
import { Public } from 'nest-keycloak-connect';
|
||||||
|
import { StartupService } from '../auth/services/startup.service';
|
||||||
|
|
||||||
|
@Controller('health')
|
||||||
|
export class HealthController {
|
||||||
|
constructor(private readonly startupService: StartupService) {}
|
||||||
|
|
||||||
|
@Public()
|
||||||
|
@Get()
|
||||||
|
getHealth() {
|
||||||
|
return this.startupService.getStatus();
|
||||||
|
}
|
||||||
|
|
||||||
|
@Public()
|
||||||
|
@Get('readiness')
|
||||||
|
getReadiness() {
|
||||||
|
return {
|
||||||
|
status: this.startupService.isHealthy() ? 'ready' : 'not-ready',
|
||||||
|
timestamp: new Date(),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
@Public()
|
||||||
|
@Get('liveness')
|
||||||
|
getLiveness() {
|
||||||
|
return {
|
||||||
|
status: 'live',
|
||||||
|
timestamp: new Date(),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
19
src/health/health.module.ts
Normal file
19
src/health/health.module.ts
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
import { Module } from '@nestjs/common';
|
||||||
|
import { TerminusModule } from '@nestjs/terminus';
|
||||||
|
import { HealthController } from './health.controller';
|
||||||
|
import { HttpModule } from '@nestjs/axios';
|
||||||
|
import { StartupService } from '../auth/services/startup.service';
|
||||||
|
import { TokenService } from '../auth/services/token.service';
|
||||||
|
import { KeycloakApiService } from '../auth/services/keycloak-api.service';
|
||||||
|
|
||||||
|
|
||||||
|
@Module({
|
||||||
|
imports: [
|
||||||
|
TerminusModule,
|
||||||
|
HttpModule,
|
||||||
|
],
|
||||||
|
providers: [StartupService, TokenService, KeycloakApiService],
|
||||||
|
controllers: [HealthController],
|
||||||
|
exports: [StartupService, TokenService, KeycloakApiService],
|
||||||
|
})
|
||||||
|
export class HealthModule {}
|
||||||
23
src/main.ts
Normal file
23
src/main.ts
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
import { NestFactory } from '@nestjs/core';
|
||||||
|
import { AppModule } from './app.module';
|
||||||
|
import { ValidationPipe, Logger } from '@nestjs/common';
|
||||||
|
import helmet from 'helmet';
|
||||||
|
import { KeycloakExceptionFilter } from './filters/keycloak-exception.filter';
|
||||||
|
|
||||||
|
async function bootstrap() {
|
||||||
|
const app = await NestFactory.create(AppModule);
|
||||||
|
const logger = new Logger('dcb-user-service');
|
||||||
|
|
||||||
|
app.use(helmet());
|
||||||
|
app.enableCors();
|
||||||
|
app.useGlobalFilters(new KeycloakExceptionFilter());
|
||||||
|
app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
|
||||||
|
app.setGlobalPrefix('api/v1');
|
||||||
|
app.enableCors({ origin: '*' })
|
||||||
|
|
||||||
|
const port = process.env.PORT || 3000;
|
||||||
|
await app.listen(port);
|
||||||
|
|
||||||
|
logger.log(`Application running on http://localhost:${port}`);
|
||||||
|
}
|
||||||
|
bootstrap();
|
||||||
210
src/users/controllers/users.controller.ts
Normal file
210
src/users/controllers/users.controller.ts
Normal file
@ -0,0 +1,210 @@
|
|||||||
|
import {
|
||||||
|
Body,
|
||||||
|
Controller,
|
||||||
|
Delete,
|
||||||
|
Get,
|
||||||
|
Param,
|
||||||
|
Post,
|
||||||
|
Put,
|
||||||
|
Query,
|
||||||
|
Logger,
|
||||||
|
HttpException,
|
||||||
|
HttpStatus,
|
||||||
|
} from "@nestjs/common";
|
||||||
|
import {
|
||||||
|
Roles,
|
||||||
|
AuthenticatedUser,
|
||||||
|
Public
|
||||||
|
} from "nest-keycloak-connect";
|
||||||
|
import { UsersService } from "../services/users.service";
|
||||||
|
import { User, CreateUserDto, UpdateUserDto, UserResponse } from "../models/user";
|
||||||
|
import { ROLES } from "../models/roles.enum";
|
||||||
|
|
||||||
|
@Controller("user")
|
||||||
|
export class UserController {
|
||||||
|
private readonly logger = new Logger(UserController.name);
|
||||||
|
|
||||||
|
constructor(private readonly userService: UsersService) {}
|
||||||
|
|
||||||
|
@Post("create")
|
||||||
|
@Roles({ roles: [ROLES.CREATE_USER] })
|
||||||
|
async createUser(
|
||||||
|
@Body() payload: CreateUserDto,
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<UserResponse> {
|
||||||
|
this.logger.log(`User ${user.sub} creating new user: ${payload.username}`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const createdUser = await this.userService.createUser(payload);
|
||||||
|
return new UserResponse(createdUser);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to create user: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to create user',
|
||||||
|
HttpStatus.BAD_REQUEST
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Put(':id')
|
||||||
|
@Roles({ roles: [ROLES.UPDATE_USER] })
|
||||||
|
async updateUser(
|
||||||
|
@Param('id') id: string,
|
||||||
|
@Body() payload: UpdateUserDto,
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<UserResponse> {
|
||||||
|
this.logger.log(`User ${user.sub} updating user: ${id}`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const updatedUser = await this.userService.updateUser(id, payload);
|
||||||
|
return new UserResponse(updatedUser);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to update user ${id}: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to update user',
|
||||||
|
HttpStatus.BAD_REQUEST
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Delete(":id")
|
||||||
|
@Roles({ roles: [ROLES.DELETE_USER] })
|
||||||
|
async deleteUser(
|
||||||
|
@Param("id") id: string,
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<{ message: string }> {
|
||||||
|
this.logger.log(`User ${user.sub} deleting user: ${id}`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
await this.userService.deleteUser(id);
|
||||||
|
return { message: `User ${id} deleted successfully` };
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to delete user ${id}: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to delete user',
|
||||||
|
HttpStatus.BAD_REQUEST
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Get()
|
||||||
|
@Roles({ roles: [ROLES.READ_USERS] })
|
||||||
|
async findAllUsers(
|
||||||
|
@Query('page') page: number = 1,
|
||||||
|
@Query('limit') limit: number = 10,
|
||||||
|
@Query('search') search: string = '',
|
||||||
|
@Query('enabled') enabled: boolean | string,
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<{ users: UserResponse[]; total: number }> {
|
||||||
|
this.logger.log(`User ${user.sub} accessing users list`);
|
||||||
|
|
||||||
|
// Convert enabled query param to boolean if provided
|
||||||
|
const enabledFilter = enabled === 'true' ? true :
|
||||||
|
enabled === 'false' ? false : undefined;
|
||||||
|
|
||||||
|
try {
|
||||||
|
const result = await this.userService.findAllUsers(
|
||||||
|
page,
|
||||||
|
limit,
|
||||||
|
search,
|
||||||
|
enabledFilter
|
||||||
|
);
|
||||||
|
|
||||||
|
return {
|
||||||
|
users: result.users.map(user => new UserResponse(user)),
|
||||||
|
total: result.total
|
||||||
|
};
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to fetch users: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to fetch users',
|
||||||
|
HttpStatus.INTERNAL_SERVER_ERROR
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Get(":id")
|
||||||
|
@Roles({ roles: [ROLES.READ_USERS] })
|
||||||
|
async getUserById(
|
||||||
|
@Param('id') id: string,
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<UserResponse> {
|
||||||
|
this.logger.log(`User ${user.sub} accessing profile of user: ${id}`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const userData = await this.userService.getUserById(id);
|
||||||
|
return new UserResponse(userData);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to fetch user ${id}: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'User not found',
|
||||||
|
HttpStatus.NOT_FOUND
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Get("profile/me")
|
||||||
|
async getCurrentUserProfile(
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<UserResponse> {
|
||||||
|
this.logger.log(`User ${user.sub} accessing own profile`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
// Utiliser l'ID de l'utilisateur authentifié
|
||||||
|
const userData = await this.userService.getUserById(user.sub);
|
||||||
|
return new UserResponse(userData);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to fetch current user profile: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to fetch user profile',
|
||||||
|
HttpStatus.NOT_FOUND
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Post(":id/roles")
|
||||||
|
@Roles({ roles: [ROLES.UPDATE_USER] })
|
||||||
|
async assignRoles(
|
||||||
|
@Param('id') id: string,
|
||||||
|
@Body() body: { roles: string[] },
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<{ message: string }> {
|
||||||
|
this.logger.log(`User ${user.sub} assigning roles to user: ${id}`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
await this.userService.assignRealmRoles(id, body.roles);
|
||||||
|
return { message: 'Roles assigned successfully' };
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to assign roles to user ${id}: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to assign roles',
|
||||||
|
HttpStatus.BAD_REQUEST
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Put(":id/password")
|
||||||
|
@Roles({ roles: [ROLES.UPDATE_USER] })
|
||||||
|
async resetPassword(
|
||||||
|
@Param('id') id: string,
|
||||||
|
@Body() body: { password: string; temporary: boolean },
|
||||||
|
@AuthenticatedUser() user: any
|
||||||
|
): Promise<{ message: string }> {
|
||||||
|
this.logger.log(`User ${user.sub} resetting password for user: ${id}`);
|
||||||
|
|
||||||
|
try {
|
||||||
|
await this.userService.resetPassword(
|
||||||
|
id,
|
||||||
|
body.password,
|
||||||
|
body.temporary ?? true
|
||||||
|
);
|
||||||
|
return { message: 'Password reset successfully' };
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to reset password for user ${id}: ${error.message}`);
|
||||||
|
throw new HttpException(
|
||||||
|
error.message || 'Failed to reset password',
|
||||||
|
HttpStatus.BAD_REQUEST
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
14
src/users/models/roles.enum.ts
Normal file
14
src/users/models/roles.enum.ts
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
export enum ROLES {
|
||||||
|
// User Management Roles
|
||||||
|
CREATE_USER = 'create-user',
|
||||||
|
UPDATE_USER = 'update-user',
|
||||||
|
DELETE_USER = 'delete-user',
|
||||||
|
READ_USERS = 'read-users',
|
||||||
|
}
|
||||||
|
|
||||||
|
export const ROLE_DESCRIPTIONS = {
|
||||||
|
[ROLES.CREATE_USER]: 'Can create new users in the system',
|
||||||
|
[ROLES.UPDATE_USER]: 'Can update existing user information',
|
||||||
|
[ROLES.DELETE_USER]: 'Can delete users from the system',
|
||||||
|
[ROLES.READ_USERS]: 'Can view the list of all users',
|
||||||
|
};
|
||||||
101
src/users/models/user.ts
Normal file
101
src/users/models/user.ts
Normal file
@ -0,0 +1,101 @@
|
|||||||
|
export class User {
|
||||||
|
id?: string;
|
||||||
|
username: string;
|
||||||
|
email: string;
|
||||||
|
firstName?: string;
|
||||||
|
lastName?: string;
|
||||||
|
enabled?: boolean = true;
|
||||||
|
emailVerified?: boolean = false;
|
||||||
|
attributes?: Record<string, any>;
|
||||||
|
realmRoles?: string[];
|
||||||
|
clientRoles?: Record<string, string[]>;
|
||||||
|
groups?: string[];
|
||||||
|
requiredActions?: string[];
|
||||||
|
credentials?: UserCredentials[];
|
||||||
|
createdTimestamp?: number;
|
||||||
|
|
||||||
|
constructor(partial?: Partial<User>) {
|
||||||
|
if (partial) {
|
||||||
|
Object.assign(this, partial);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export class UserCredentials {
|
||||||
|
type: string;
|
||||||
|
value: string;
|
||||||
|
temporary: boolean = false;
|
||||||
|
|
||||||
|
constructor(type: string, value: string, temporary: boolean = false) {
|
||||||
|
this.type = type;
|
||||||
|
this.value = value;
|
||||||
|
this.temporary = temporary;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export class CreateUserDto {
|
||||||
|
username: string;
|
||||||
|
email: string;
|
||||||
|
firstName?: string;
|
||||||
|
lastName?: string;
|
||||||
|
password: string;
|
||||||
|
enabled?: boolean = true;
|
||||||
|
emailVerified?: boolean = false;
|
||||||
|
attributes?: Record<string, any>;
|
||||||
|
realmRoles?: string[];
|
||||||
|
groups?: string[];
|
||||||
|
|
||||||
|
constructor(partial?: Partial<CreateUserDto>) {
|
||||||
|
if (partial) {
|
||||||
|
Object.assign(this, partial);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export class UpdateUserDto {
|
||||||
|
username?: string;
|
||||||
|
email?: string;
|
||||||
|
firstName?: string;
|
||||||
|
lastName?: string;
|
||||||
|
enabled?: boolean;
|
||||||
|
emailVerified?: boolean;
|
||||||
|
attributes?: Record<string, any>;
|
||||||
|
realmRoles?: string[];
|
||||||
|
groups?: string[];
|
||||||
|
|
||||||
|
constructor(partial?: Partial<UpdateUserDto>) {
|
||||||
|
if (partial) {
|
||||||
|
Object.assign(this, partial);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export class UserResponse {
|
||||||
|
id: string;
|
||||||
|
username: string;
|
||||||
|
email: string;
|
||||||
|
firstName?: string;
|
||||||
|
lastName?: string;
|
||||||
|
enabled: boolean;
|
||||||
|
emailVerified: boolean;
|
||||||
|
attributes?: Record<string, any>;
|
||||||
|
realmRoles?: string[];
|
||||||
|
clientRoles?: Record<string, string[]>;
|
||||||
|
groups?: string[];
|
||||||
|
createdTimestamp: number;
|
||||||
|
|
||||||
|
constructor(user: any) {
|
||||||
|
this.id = user.id;
|
||||||
|
this.username = user.username;
|
||||||
|
this.email = user.email;
|
||||||
|
this.firstName = user.firstName;
|
||||||
|
this.lastName = user.lastName;
|
||||||
|
this.enabled = user.enabled;
|
||||||
|
this.emailVerified = user.emailVerified;
|
||||||
|
this.attributes = user.attributes;
|
||||||
|
this.realmRoles = user.realmRoles;
|
||||||
|
this.clientRoles = user.clientRoles;
|
||||||
|
this.groups = user.groups;
|
||||||
|
this.createdTimestamp = user.createdTimestamp;
|
||||||
|
}
|
||||||
|
}
|
||||||
311
src/users/services/users.service.ts
Normal file
311
src/users/services/users.service.ts
Normal file
@ -0,0 +1,311 @@
|
|||||||
|
import { Injectable, Logger, NotFoundException, BadRequestException, ConflictException } from '@nestjs/common';
|
||||||
|
import { KeycloakApiService } from '../../auth/services/keycloak-api.service';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
import { CreateUserDto, UpdateUserDto } from '../models/user';
|
||||||
|
|
||||||
|
@Injectable()
|
||||||
|
export class UsersService {
|
||||||
|
private readonly logger = new Logger(UsersService.name);
|
||||||
|
private readonly realm: string;
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly keycloakApi: KeycloakApiService,
|
||||||
|
private readonly configService: ConfigService,
|
||||||
|
) {
|
||||||
|
this.realm = this.configService.get<string>('keycloak.realm')!;
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserById(userId: string): Promise<any> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Fetching user by ID: ${userId}`);
|
||||||
|
const user = await this.keycloakApi.getUserById(this.realm, userId);
|
||||||
|
|
||||||
|
if (!user) {
|
||||||
|
throw new NotFoundException(`User with ID ${userId} not found`);
|
||||||
|
}
|
||||||
|
|
||||||
|
return user;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to fetch user ${userId}: ${error.message}`);
|
||||||
|
|
||||||
|
if (error instanceof NotFoundException) {
|
||||||
|
throw error;
|
||||||
|
}
|
||||||
|
|
||||||
|
throw new NotFoundException(`User with ID ${userId} not found`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserProfile(accessToken: string): Promise<any> {
|
||||||
|
try {
|
||||||
|
this.logger.debug('Fetching user profile from token');
|
||||||
|
const profile = await this.keycloakApi.getUserProfile(this.realm, accessToken);
|
||||||
|
|
||||||
|
if (!profile) {
|
||||||
|
throw new NotFoundException('User profile not found');
|
||||||
|
}
|
||||||
|
|
||||||
|
return profile;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to fetch user profile: ${error.message}`);
|
||||||
|
throw new NotFoundException('Failed to fetch user profile');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
async findAllUsers(
|
||||||
|
page: number = 1,
|
||||||
|
limit: number = 10,
|
||||||
|
search: string = '',
|
||||||
|
enabled?: boolean
|
||||||
|
): Promise<{ users: any[]; total: number }> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Fetching users - page: ${page}, limit: ${limit}, search: ${search}`);
|
||||||
|
|
||||||
|
// Récupérer tous les utilisateurs avec les filtres
|
||||||
|
let users = await this.keycloakApi.getUsers(this.realm);
|
||||||
|
|
||||||
|
// Appliquer les filtres
|
||||||
|
if (search) {
|
||||||
|
const searchLower = search.toLowerCase();
|
||||||
|
users = users.filter(user =>
|
||||||
|
user.username?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.email?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.firstName?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.lastName?.toLowerCase().includes(searchLower)
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (enabled !== undefined) {
|
||||||
|
users = users.filter(user => user.enabled === enabled);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Pagination
|
||||||
|
const startIndex = (page - 1) * limit;
|
||||||
|
const endIndex = startIndex + limit;
|
||||||
|
const paginatedUsers = users.slice(startIndex, endIndex);
|
||||||
|
|
||||||
|
return {
|
||||||
|
users: paginatedUsers,
|
||||||
|
total: users.length
|
||||||
|
};
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to fetch users: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to fetch users');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async createUser(userData: CreateUserDto): Promise<any> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Creating new user: ${userData.username}`);
|
||||||
|
|
||||||
|
// Validation basique
|
||||||
|
if (!userData.username || !userData.email) {
|
||||||
|
throw new BadRequestException('Username and email are required');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Vérifier si l'utilisateur existe déjà
|
||||||
|
const existingUsers = await this.keycloakApi.getUsers(this.realm);
|
||||||
|
const userExists = existingUsers.some(user =>
|
||||||
|
user.username === userData.username || user.email === userData.email
|
||||||
|
);
|
||||||
|
|
||||||
|
if (userExists) {
|
||||||
|
throw new ConflictException('User with this username or email already exists');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Préparer les données pour Keycloak
|
||||||
|
const keycloakUserData = {
|
||||||
|
username: userData.username,
|
||||||
|
email: userData.email,
|
||||||
|
firstName: userData.firstName,
|
||||||
|
lastName: userData.lastName,
|
||||||
|
enabled: userData.enabled ?? true,
|
||||||
|
emailVerified: userData.emailVerified ?? false,
|
||||||
|
attributes: userData.attributes || {},
|
||||||
|
credentials: userData.password ? [
|
||||||
|
{
|
||||||
|
type: 'password',
|
||||||
|
value: userData.password,
|
||||||
|
temporary: false
|
||||||
|
}
|
||||||
|
] : [],
|
||||||
|
realmRoles: userData.realmRoles || [],
|
||||||
|
groups: userData.groups || []
|
||||||
|
};
|
||||||
|
|
||||||
|
const createdUser = await this.keycloakApi.createUser(this.realm, keycloakUserData);
|
||||||
|
this.logger.log(`User created successfully: ${userData.username}`);
|
||||||
|
|
||||||
|
return createdUser;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to create user ${userData.username}: ${error.message}`);
|
||||||
|
|
||||||
|
if (error instanceof BadRequestException || error instanceof ConflictException) {
|
||||||
|
throw error;
|
||||||
|
}
|
||||||
|
|
||||||
|
throw new BadRequestException('Failed to create user');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async updateUser(id: string, userData: UpdateUserDto): Promise<any> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Updating user: ${id}`);
|
||||||
|
|
||||||
|
// Vérifier que l'utilisateur existe
|
||||||
|
const existingUser = await this.getUserById(id);
|
||||||
|
|
||||||
|
if (!existingUser) {
|
||||||
|
throw new NotFoundException(`User with ID ${id} not found`);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Préparer les données de mise à jour
|
||||||
|
const updateData: any = {};
|
||||||
|
|
||||||
|
if (userData.username !== undefined) updateData.username = userData.username;
|
||||||
|
if (userData.email !== undefined) updateData.email = userData.email;
|
||||||
|
if (userData.firstName !== undefined) updateData.firstName = userData.firstName;
|
||||||
|
if (userData.lastName !== undefined) updateData.lastName = userData.lastName;
|
||||||
|
if (userData.enabled !== undefined) updateData.enabled = userData.enabled;
|
||||||
|
if (userData.emailVerified !== undefined) updateData.emailVerified = userData.emailVerified;
|
||||||
|
if (userData.attributes !== undefined) updateData.attributes = userData.attributes;
|
||||||
|
if (userData.realmRoles !== undefined) updateData.realmRoles = userData.realmRoles;
|
||||||
|
if (userData.groups !== undefined) updateData.groups = userData.groups;
|
||||||
|
|
||||||
|
const updatedUser = await this.keycloakApi.updateUser(this.realm, id, updateData);
|
||||||
|
this.logger.log(`User updated successfully: ${id}`);
|
||||||
|
|
||||||
|
return updatedUser;
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to update user ${id}: ${error.message}`);
|
||||||
|
|
||||||
|
if (error instanceof NotFoundException) {
|
||||||
|
throw error;
|
||||||
|
}
|
||||||
|
|
||||||
|
throw new BadRequestException('Failed to update user');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async deleteUser(id: string): Promise<void> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Deleting user: ${id}`);
|
||||||
|
|
||||||
|
// Vérifier que l'utilisateur existe
|
||||||
|
const existingUser = await this.getUserById(id);
|
||||||
|
|
||||||
|
if (!existingUser) {
|
||||||
|
throw new NotFoundException(`User with ID ${id} not found`);
|
||||||
|
}
|
||||||
|
|
||||||
|
await this.keycloakApi.deleteUser(this.realm, id);
|
||||||
|
this.logger.log(`User deleted successfully: ${id}`);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to delete user ${id}: ${error.message}`);
|
||||||
|
|
||||||
|
if (error instanceof NotFoundException) {
|
||||||
|
throw error;
|
||||||
|
}
|
||||||
|
|
||||||
|
throw new BadRequestException('Failed to delete user');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async assignRealmRoles(userId: string, roles: string[]): Promise<void> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Assigning roles to user ${userId}: ${roles.join(', ')}`);
|
||||||
|
|
||||||
|
// Vérifier que l'utilisateur existe
|
||||||
|
await this.getUserById(userId);
|
||||||
|
|
||||||
|
await this.keycloakApi.assignRealmRoles(this.realm, userId, roles);
|
||||||
|
this.logger.log(`Roles assigned successfully to user: ${userId}`);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to assign roles to user ${userId}: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to assign roles to user');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async removeRealmRoles(userId: string, roles: string[]): Promise<void> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Removing roles from user ${userId}: ${roles.join(', ')}`);
|
||||||
|
|
||||||
|
// Vérifier que l'utilisateur existe
|
||||||
|
await this.getUserById(userId);
|
||||||
|
|
||||||
|
await this.keycloakApi.removeRealmRoles(this.realm, userId, roles);
|
||||||
|
this.logger.log(`Roles removed successfully from user: ${userId}`);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to remove roles from user ${userId}: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to remove roles from user');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async resetPassword(userId: string, newPassword: string, temporary: boolean = true): Promise<void> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Resetting password for user: ${userId}`);
|
||||||
|
|
||||||
|
// Vérifier que l'utilisateur existe
|
||||||
|
await this.getUserById(userId);
|
||||||
|
|
||||||
|
await this.keycloakApi.resetPassword(this.realm, userId, newPassword, temporary);
|
||||||
|
this.logger.log(`Password reset successfully for user: ${userId}`);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to reset password for user ${userId}: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to reset password');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async searchUsers(query: string, maxResults: number = 50): Promise<any[]> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Searching users with query: ${query}`);
|
||||||
|
|
||||||
|
const allUsers = await this.keycloakApi.getUsers(this.realm);
|
||||||
|
|
||||||
|
const searchLower = query.toLowerCase();
|
||||||
|
const filteredUsers = allUsers.filter(user =>
|
||||||
|
user.username?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.email?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.firstName?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.lastName?.toLowerCase().includes(searchLower) ||
|
||||||
|
user.id?.toLowerCase().includes(searchLower)
|
||||||
|
);
|
||||||
|
|
||||||
|
return filteredUsers.slice(0, maxResults);
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to search users: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to search users');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async getUserCount(): Promise<{ total: number; enabled: number; disabled: number }> {
|
||||||
|
try {
|
||||||
|
this.logger.debug('Getting user count statistics');
|
||||||
|
|
||||||
|
const allUsers = await this.keycloakApi.getUsers(this.realm);
|
||||||
|
|
||||||
|
return {
|
||||||
|
total: allUsers.length,
|
||||||
|
enabled: allUsers.filter(user => user.enabled).length,
|
||||||
|
disabled: allUsers.filter(user => !user.enabled).length
|
||||||
|
};
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to get user count: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to get user statistics');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async toggleUserStatus(userId: string, enabled: boolean): Promise<any> {
|
||||||
|
try {
|
||||||
|
this.logger.debug(`Setting user ${userId} enabled status to: ${enabled}`);
|
||||||
|
|
||||||
|
const user = await this.getUserById(userId);
|
||||||
|
|
||||||
|
return await this.updateUser(userId, { enabled });
|
||||||
|
} catch (error: any) {
|
||||||
|
this.logger.error(`Failed to toggle user status for ${userId}: ${error.message}`);
|
||||||
|
throw new BadRequestException('Failed to update user status');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
23
src/users/users.module.ts
Normal file
23
src/users/users.module.ts
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
import { Module } from '@nestjs/common'
|
||||||
|
import { JwtModule } from '@nestjs/jwt'
|
||||||
|
import { HttpModule } from '@nestjs/axios';
|
||||||
|
import { TokenService } from '../auth/services/token.service'
|
||||||
|
import { ClientCredentialsGuard } from '../auth/guards/client-credentials.guard';
|
||||||
|
import { UsersService } from './services/users.service'
|
||||||
|
import { UserController } from './controllers/users.controller'
|
||||||
|
import { KeycloakApiService } from '../auth/services/keycloak-api.service';
|
||||||
|
|
||||||
|
|
||||||
|
@Module({
|
||||||
|
imports: [
|
||||||
|
HttpModule,
|
||||||
|
JwtModule.register({}),
|
||||||
|
],
|
||||||
|
providers: [UsersService, KeycloakApiService, TokenService],
|
||||||
|
controllers: [UserController],
|
||||||
|
exports: [UsersService, KeycloakApiService, TokenService, JwtModule],
|
||||||
|
})
|
||||||
|
export class UsersModule {}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
25
test/app.e2e-spec.ts
Normal file
25
test/app.e2e-spec.ts
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
import { Test, TestingModule } from '@nestjs/testing';
|
||||||
|
import { INestApplication } from '@nestjs/common';
|
||||||
|
import request from 'supertest';
|
||||||
|
import { App } from 'supertest/types';
|
||||||
|
import { AppModule } from './../src/app.module';
|
||||||
|
|
||||||
|
describe('AppController (e2e)', () => {
|
||||||
|
let app: INestApplication<App>;
|
||||||
|
|
||||||
|
beforeEach(async () => {
|
||||||
|
const moduleFixture: TestingModule = await Test.createTestingModule({
|
||||||
|
imports: [AppModule],
|
||||||
|
}).compile();
|
||||||
|
|
||||||
|
app = moduleFixture.createNestApplication();
|
||||||
|
await app.init();
|
||||||
|
});
|
||||||
|
|
||||||
|
it('/ (GET)', () => {
|
||||||
|
return request(app.getHttpServer())
|
||||||
|
.get('/')
|
||||||
|
.expect(200)
|
||||||
|
.expect('Hello World!');
|
||||||
|
});
|
||||||
|
});
|
||||||
9
test/jest-e2e.json
Normal file
9
test/jest-e2e.json
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
{
|
||||||
|
"moduleFileExtensions": ["js", "json", "ts"],
|
||||||
|
"rootDir": ".",
|
||||||
|
"testEnvironment": "node",
|
||||||
|
"testRegex": ".e2e-spec.ts$",
|
||||||
|
"transform": {
|
||||||
|
"^.+\\.(t|j)s$": "ts-jest"
|
||||||
|
}
|
||||||
|
}
|
||||||
40
test/token.service.spec.ts
Normal file
40
test/token.service.spec.ts
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
import { Test, TestingModule } from '@nestjs/testing';
|
||||||
|
import { TokenService } from '../src/auth/services/token.service';
|
||||||
|
import { HttpService } from '@nestjs/axios';
|
||||||
|
import { ConfigService } from '@nestjs/config';
|
||||||
|
import { of } from 'rxjs';
|
||||||
|
|
||||||
|
describe('TokenService', () => {
|
||||||
|
let service: TokenService;
|
||||||
|
const mockHttp = { post: jest.fn() };
|
||||||
|
const mockConfig = {
|
||||||
|
get: (key: string) => {
|
||||||
|
const map = {
|
||||||
|
'keycloak.serverUrl': 'https://keycloak-dcb.app.cameleonapp.com',
|
||||||
|
'keycloak.realm': 'master',
|
||||||
|
'keycloak.clientId': 'dcb-cc',
|
||||||
|
'keycloak.clientSecret': 'secret',
|
||||||
|
'keycloak.tokenBufferSeconds': 30,
|
||||||
|
};
|
||||||
|
return map[key];
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
beforeEach(async () => {
|
||||||
|
const module: TestingModule = await Test.createTestingModule({
|
||||||
|
providers: [
|
||||||
|
TokenService,
|
||||||
|
{ provide: HttpService, useValue: mockHttp },
|
||||||
|
{ provide: ConfigService, useValue: mockConfig },
|
||||||
|
],
|
||||||
|
}).compile();
|
||||||
|
|
||||||
|
service = module.get<TokenService>(TokenService);
|
||||||
|
});
|
||||||
|
|
||||||
|
it('should acquire a token', async () => {
|
||||||
|
mockHttp.post.mockReturnValue(of({ data: { access_token: 'abc123', expires_in: 60 } }));
|
||||||
|
const token = await service.acquireToken();
|
||||||
|
expect(token).toBe('abc123');
|
||||||
|
});
|
||||||
|
});
|
||||||
4
tsconfig.build.json
Normal file
4
tsconfig.build.json
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
{
|
||||||
|
"extends": "./tsconfig.json",
|
||||||
|
"exclude": ["node_modules", "test", "dist", "**/*spec.ts"]
|
||||||
|
}
|
||||||
25
tsconfig.json
Normal file
25
tsconfig.json
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
{
|
||||||
|
"compilerOptions": {
|
||||||
|
"module": "nodenext",
|
||||||
|
"moduleResolution": "nodenext",
|
||||||
|
"resolvePackageJsonExports": true,
|
||||||
|
"esModuleInterop": true,
|
||||||
|
"isolatedModules": true,
|
||||||
|
"declaration": true,
|
||||||
|
"removeComments": true,
|
||||||
|
"emitDecoratorMetadata": true,
|
||||||
|
"experimentalDecorators": true,
|
||||||
|
"allowSyntheticDefaultImports": true,
|
||||||
|
"target": "ES2023",
|
||||||
|
"sourceMap": true,
|
||||||
|
"outDir": "./dist",
|
||||||
|
"baseUrl": "./",
|
||||||
|
"incremental": true,
|
||||||
|
"skipLibCheck": true,
|
||||||
|
"strictNullChecks": true,
|
||||||
|
"forceConsistentCasingInFileNames": true,
|
||||||
|
"noImplicitAny": false,
|
||||||
|
"strictBindCallApply": false,
|
||||||
|
"noFallthroughCasesInSwitch": false
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user